Why you should care about a data breach

(You may have read about one affecting a password manager recently.)

Data breaches occur so frequently that it’s easy to tune out or convince yourself they’re not worth paying attention to. “Are these breaches really all that bad?” “Is anything really going to happen if I ignore a breach that might have affected one of my personal accounts?”

It’s never been more important to be proactive when you hear about a data breach that affects one of your online accounts. To do this, you don’t need to be a security professional or devour the news every day. You simply need to know the potential impacts of data breaches, and how the right tools can help you quickly and effectively respond to them.

What is a data breach?

Let’s start with a quick data breach definition. The term refers to any security incident where a criminal gains access to sensitive data, such as financial information or social security numbers. Data obtained via a data breach can be sold on the dark web, held under ransom for payment, or leaked to the public. Attackers utilize many different techniques to sneak past their target’s digital defenses, such as social engineering.

Now, let’s dig into how a data breach can affect you.

Losing personal account access from a data breach

Some services protect their users’ login details better than others. If a company is breached and they haven’t been following best security practices, it’s possible that an attacker could obtain your login credentials and try to sign in to your personal account.

If the thief gains access to your account, they could try to change the password. This would be like someone running inside your house while you’re on vacation and changing the locks on your doors. People have been locked out of accounts before this way.

Losing access to other accounts that use the same password

Many people use the same password, or just a handful or different passwords, for all of their online accounts. While convenient, it’s also a security risk.

If a company is breached and your password is exposed, an attacker might use a technique called credential stuffing to test whether they can use that same login credential to sign in to any of your other online accounts.

For example, imagine an attacker obtains a password for one of your less important accounts, like a shopping website. A thief might wonder whether that same password can grant them access to higher-value accounts, like your online banking.

Stolen personal information

To get the most out of the internet, we often have to share some of our sensitive personal information. You might have shared your full name with a social media platform, your home address with an e-commerce company, or your date of birth with a streaming service.

If one of these services is breached, it’s possible that some of the information you shared with them will be exposed. Attackers want these personal details because they can help them access your other accounts and effectively impersonate you (more on that later).

Stolen credit cards and other financial information

Some of your accounts will likely be tied to paid services. In these situations, you’ll likely be asked to enter a credit or debit card. That could be for a subscription, to complete individual orders, or for services like OpenAI, which charge based on your usage.

Companies should take appropriate measures to safeguard your financial information. Unfortunately, this isn’t always the case. Some breaches have exposed customers' financial information before, allowing attackers to make fraudulent transactions.

Identity theft and impersonation

A knock-on effect of a data breach can be impersonation. If an attacker obtains one of your passwords and successfully signs in to the associated account, they might try to use that access to manipulate someone else. A criminal could pose as you and ask someone you know to transfer them money, or share a password for a work-related account.

Similarly, if a criminal obtains some of your personal details, like your full name, current address, and date of birth, they can use this to impersonate you. Many companies will ask security questions, for example, that can be answered correctly using this information.

How 1Password helps to protect you against data breaches

1Password makes security simple. Here’s how our password manager helps you minimize and avoid the impact of a data breach:

Watchtower protects you during a data breach

No-one can keep track of every breach happening around the world. With Watchtower, you don’t have to. 1Password’s digital lookout monitors the world-renowned Have I Been Pwned database and will alert you if any of your saved passwords appear in a known data breach.

These notifications ensure you know about relevant breaches as soon as possible. Armed with this information, you can update the exposed password to something new, strong and unique, shutting attackers out of the account before they can cause any trouble.

1Password’s security model

Okay, but what happens if your password manager has been breached? It’s an understandable concern, especially if you’ve read recent headlines. The good news is that if you’re a 1Password customer, there’s nothing you need to do and no reason to worry.

If there was an attack on 1Password’s servers, the best an attacker could hope to find is an encrypted copy of your vault data. The criminal wouldn’t be able to read this data without two pieces of information:

• Your account password. This is the password you choose, and the only one you need to remember in order to access your vaults.

Some password managers only rely on an account password to encrypt your data. 1Password goes a step further by utilizing…

• Your Secret Key. It’s an account-specific, 128-bit strong encryption ingredient that contains 34 letters and numbers, separated by dashes. Crucially, your Secret Key is never sent to us in full. We receive only the first eight characters, which are used to identify your account.

Together, your account password and Secret Key form an incredibly strong encryption key that’s challenging – and in practical terms, virtually impossible – for a hacker to crack.

The bottom line

Breaches do occur, and are likely to continue occurring for the foreseeable future. No defense is perfect, which is why security incidents can happen to companies large and small, including those that develop password managers.

If you don’t work in security, it can be tempting to bury your head in the sand. But there’s a better choice: be proactive and update exposed passwords before they’re exploited by criminals.

With a password manager like 1Password, you can create strong passwords and use two-factor authentication everywhere it’s offered. Our security model also ensures your vault data is effectively useless to attackers, even if they somehow got their hands on it.

1Password’s built-in Watchtower also helps you respond to any data breach so you can lock down your accounts before attackers have a chance to do any damage.

Don’t wait for a breach to impact your data. Instead, stay secure with just a few simple steps.

Nick Summers

Content Marketing Manager