Hackers account for 90% of login attempts at online retailers

Selling stolen personal data is a big business for hackers: Somewhere on the dark web, your e-mail address and a few passwords are probably for sale (hopefully, old ones). Cyber criminals buy troves of this information to try to login to websites where they can grab something valuable like cash, airline points, or merchandise like expensive cheese. Yes, cheese.
Online retailers are hit the most by these attacks, according to a report by cyber security firm Shape Security. Hackers use programs to apply stolen data in a flood of login attempts, called “credential stuffing.” These days, more than 90% of e-commerce sites’ global login traffic comes from these attacks. The airline and consumer banking industries are also under siege, with about 60% of login attempts coming from criminals.
These attacks are successful as often as 3% of the time, and the costs quickly add up for businesses, Shape says. This type of fraud costs the e-commerce sector about $6 billion a year, while the consumer banking industry loses out on about $1.7 billion annually. The hotel and airline businesses are also major targets—the theft of loyalty points is a thing—costing a combined $700 million every year.

Targeting “little monsters”

“Criminals harvest usernames and passwords from data breaches and test them on every website and mobile app imaginable,” Shape said in its report. The Mountain View, California-based company says it monitors 1.6 billion accounts for credential stuffing. The seven-year-old firm’s co-founders were Pentagon advisors and worked at defense contractor Raytheon.
The process starts when hackers break into databases and steal login information. Some of the best known “data spills” took place at Equifax and Yahoo, but they happen fairly regularly—there were 51 reported breaches last year, compromising 2.3 billion credentials, according to Shape. Hackers frequently target web forums: The Lady Gaga “Little Monster” fan site had a breach last year that reportedly impacted about 1 million accounts containing birthday, password, and e-mail information.
READ MORE !!!