Just a disclaimer that just because an incident happens in another country definitely does not mean that it cannot happen in the United States. In fact, it’s likely that if something is active, it is going on in multiple countries at the same time. In a recent case, however, it was a data breach of the users of the UK National Lottery. The third party, Camelot UK Lotteries announced a breach where hackers accessed up to 150 accounts by using the credential stuffing method.
We’ve talked about this recently. Credential stuffing is where the bad actors use login names and passwords that they gained from elsewhere (perhaps the dark web) and reused them on other sites. In this case, the spokesperson at Camelot said it’s likely this is how the accounts were accessed. And this can happen in any country at any time. In fact, this is being blamed for unauthorized access more and more often these days.
And it is also possible, that the credentials used were stolen at the end of 2016 when the UK National Lottery was breached and 26,500 passwords were stolen.
That said, all users of the National Lottery site, to the tune of 10.5 million, are being urged to change passwords for their National Lottery accounts as well as for any site they used the same password or a similar password. That’s good advice. Each online account should have its own set of credentials to prevent credential stuffing from succeeding. And if you haven’t changed your passwords in a while, make an effort to do so more often.
Remember when creating strong passwords to use at least eight characters. Mix them up and use upper and lower case letters as well as numbers and special characters. The idea is to make them as difficult as possible to guess or to be figured out in a brute force password attack. So don’t use “football.” That one remains toward the top of the most common passwords lists almost every year. And really, we can all be more creative than that.
Camelot found “suspicious activity” involving some lottery accounts as it was performing “regular security monitoring” and believes that only “very limited information” was gained about the users. That included the first name and amount of money that was loaded into their National Lottery accounts, at a minimum.
They also reported that less than 10 user accounts showed some limited activity after they were breached. They claim that no one has suffered a financial loss in this.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
