A breach that potentially leaked the user names and passwords of LivingSocial’s more than 70 million users could seriously impact the subscribers, if they reused their passwords on other sites, security experts said this week.
On April 27, the deal-finding service alerted its users that criminals had breached the company’s security and taken some customers’ user names and passwords, as well as names, email addresses and dates of birth for some users. The passwords were stored as hashed values, although using SHA-1, a weaker hashing algorithm. This raises the possibility that some passwords could be deciphered.
LivingSocial forced every user to change their password, but previous data breaches have shown that a majority of people reuse passwords across sites, threatening their accounts on other Web services and even their employer’s network.
“For enterprises, it’s important to consider the possibility that some of your employees may have used the same password on LivingSocial that they use to access their work email and VPN accounts,” Tom Cross, director of security research at network-protection provider Lancope said in a statement sent to eWEEK.
“IT security teams should be proactively hunting for weak passwords in their networks, and they should assess the capabilities that they have for identifying compromised accounts,” Cross’ statement said.
Weak passwords and the reuse of user credentials across sites have been identified as the most serious issues for customers following breaches. In June 2012, social-networking site LinkedIn notified its users that online thieves had stolen more than 6 million passwords, raising the possibility that decrypted passwords could be used against corporate systems.
In July, an analysis of a password file containing approximately 500,000 Yahoo Voices accounts found that 59 percent of subscribers who had accounts on another compromised service had reused their passwords.
In many cases, the strength of passwords becomes irrelevant because some firms have failed to encrypt their password file, a security misstep that allows attackers to have ready access to the entire password database.
“If you use LivingSocial it’s critical that you change your password immediately,” Ross Barrett, senior manager of security engineering for vulnerability management firm Rapid7, said in a statement sent to eWEEK. “And if you, like many people do, use the same password for other online accounts, change those ASAP. Once the passwords are uncovered, hackers will turn to popular sites like Facebook, LinkedIn, Gmail and so on.”
The costs of breaches can quickly build up, not just for companies, but for customers. In an analysis of the 2012 Utah Department of Health breach, analyst firm Javelin Strategy & Research found that the loss of 780,000 user records—including about 280,000 Social Security numbers—would likely add up to more than $400 million in fraud and another $100 million in costs. The state agency, however, will likely pay less than $10 million, unless additional fines are levied.
In the LivingSocial breach, the online thieves apparently did not get access to users’ credit-card numbers or transactions, the company stated. “We are working with internal and external forensic security teams to investigate the nature of the incident and to further improve our security systems, and we are working with law enforcement to investigate this incident,” the company said in an online statement.