Guest post by cybersecurity experts Mark Hurley and Carmine Cicalese
According to multiple sources, it was disclosed last Friday that more than 16 billion sets of account credentials (i.e., user IDs and passwords) that were stolen from Google, Facebook and Apple over time have been aggregated into a single data set that is now easily accessible by cybercriminals. It is unclear when the data was originally taken but its aggregation has simplified cybertheft. Indeed, so much data is involved it is likely the targeted organizations are unsure of what exactly is included.
More importantly, the purloined information is much broader than just login credentials to access these companies’ platforms. Rather, it includes passwords for all kinds of client accounts, including bank, custodial, email and telecom.
How could this happen? The three organizations make billions of dollars collecting and selling customer information to advertisers. Consequently, they regularly gather immense amounts of data for all kinds of accounts.
In fact, unless a client has turned on a variety of privacy and security settings on their devices, apps, browsers and search engines, the credentials for every account accessed with that device are automatically stored in multiple places. Google and Apple also offer their own versions of password managers to store their clients’ passwords and user IDs. Further, all three offer single-sign-on (SSO) features to allow customers to access numerous accounts using just the password necessary to access their platform.
The loss and aggregation of so many credentials is potentially very bad news for advisors and their clients. Both are already frequently targeted by cybercriminals who are some of the earliest and most effective adopters of artificial intelligence software, which will enable them to quickly sort through the stolen data and identify cybertheft opportunities. Undoubtedly, many will quickly try and steal money directly from client bank and custodial accounts using compromised credentials.
However, passwords for telecom, email and social media accounts also create countless opportunities for social engineering attacks on wealth managers. Numerous ones involving deep fakes—very accurate clones of voices and images of clients and employees made from videos downloaded from social media accounts—already have been used to steal millions of dollars of client assets.
Additionally, cybercriminals routinely use passwords for telecom accounts to divert cell phones and intercept communications—including for multi-factor authentication and transaction confirmation—as well as passwords for email accounts to initiate fraudulent transactions and indirectly attack wealth managers.
Given all this, what should industry participants do? We recommend advisors immediately alert clients to these risks and encourage them to take the following steps:
1. Reset the passwords to financial, telecom, email and social media accounts using a different, lengthy (20 to 25 digit) random password for each account.
2. Engage dual authentication protocols for all financial, email, telecom and social media accounts.
3. Use a password manager—other than the ones provided by Google or Apple—to help store, manage and generate random strong passwords for every login.
4. Engage the security and privacy settings on devices—about 60 on an Apple device and 120 on a Windows/Android device—as well as on browsers and search engines so they stop automatically recording user IDs and passwords each time the user accesses an account, blocking companies from collecting them.
Long before this disclosure, wealth managers and their clients were attractive targets for cybercriminals. The aggregation of so many stolen account credentials will undoubtedly increase the frequency and sophistication of their attacks. Those firms that ignore this new, increased risk may soon pay a price.
Mark Hurley is the CEO of Digital Privacy & Protection. Carmine Cicalese, COL, U.S. Army Retired, is the President of Cyber CIC.








