Forest Global Training Partners

Cyber Risks · Krebs on Security

How to Tell Data Leaks from Publicity Stunts

Summary: Deloitte researcher Allison Nixon published a paper of fact-checking techniques for data breach claims, including searching for unique artifacts like odd passwords or email addresses to reveal a recycled leak and testing whether emails in a claimed dump already have accounts at the allegedly breached site. Nixon notes the tests only show a leak is fake, not whether a compromise occurred, and cites a hoax in which media repeated a hacker's claim of stealing almost seven million Dropbox login credentials that Dropbox said were likely taken from other services.

Key Takeaway: Nixon describes a flood of fake breach claims posted repeatedly on Pastebin and says only a tiny percentage are legitimate, so a single unverified report can move media coverage and damage a company's reputation before anyone checks whether the data was recycled from an earlier leak.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related