30% of CEOs have had their credentials leaked

Username and password re-use potentially puts corporate information at risk - study

stressed man

Almost one in three CEOs have had their usernames and passwords leaked as part of a data breach, new figures have shown.

Infosec company F-Secure analysed the known email addresses of more than 200 CEOs from top businesses across ten countries, comparing these details to leaked spam lists and account databases distributed by hackers.

Advertisement - Article continues below

It found that 30% of CEOs had their password leaked when a service they had signed up for with their corporate account fell victim to a breach.

The biggest cause of this was professional networking service LinkedIn, which was linked to 53% of the leaked accounts F-Secure analysed. Hackers infiltrated the service back in 2012, then last year released the account details of 117 million people.

Next on the list was Dropbox, which 18% of CEOs had signed up to. F-Secure did, however, point out the caveat that someone else could have used a CEO's email address to attempt to sign up for a service.

The issue of password re-use - where people use the same login details for multiple services - means that CEOs may need to change the passwords for other services than those their email addresses were leaked by.

For instance, hackers could try CEOs' credentials leaked in the LinkedIn and Dropbox breaches to attempt to gain access to sensitive corporate information through credential re-use attacks.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"This study once again underscores the importance of proper password hygiene," said F-Secure CISO Erka Koivunen. "The CEO's credentials may have leaked even when they have done nothing wrong.

"We can assume that many of the services we've created an account in have already been compromised and the old passwords are out there on the internet, just waiting for targeted, motivated attackers to try them against other services."

In addition to this, more than 80% of CEOs were found to have had personal information - including email addresses, physical addresses, phone numbers and dates of birth - exposed via leaked marketing databases and spam lists.

In fact, less than one in five CEOs had no leaks whatsoever associated with their email address.

On the other hand, Koivunen also pointed out that signing up to services with a privately-controlled email account may not necessarily be any more secure.

"When using a private email, a personal phone number or a home address to register for a service that the CEO uses to conduct official business, the CEO effectively denies the company's IT, communications, IPR, legal, and security teams a chance to protect the credentials, monitor their misuse or attempts to compromise them and makes it nearly impossible to recover them later," he said.

"To an attacker, a CEO who uses private email to register for a service they use in an official capacity spells a loner - someone who goes it alone and doesn't bother to rely on his/her staff to provide protection."

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Putting a spotlight on cyber security

An examination of the current cyber security landscape

Download now

The economics of infrastructure scalability

Find the most cost-effective and least risky way to scale

Download now

IT operations overload hinders digital transformation

Clearing the path towards a modernised system of agreement

Download now
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/security/ethical-hacking/356252/poorly-secured-banking-apps-lead-to-cyber-threats
ethical hacking

Mobile banking apps are exposing user data to attackers

26 Jun 2020

Most Popular

Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/security/vulnerability/356295/microsoft-patches-high-risk-flaws-that-can-be-exploited-with-a
vulnerability

Microsoft releases urgent patch for high-risk Windows 10 flaws

1 Jul 2020
Visit/laptops/34623/how-to-connect-one-two-or-more-monitors-to-your-laptop-including-usb-type-c
Laptops

How to connect one, two or more monitors to your laptop

29 Jun 2020