4,23% of leaked digital identities in May, 2019 are D/A/CH accounts

4,23% of the compromised accounts (email address and password combos) in May, 2019 were from the D/A/CH region. Only in Germany 461.552 hacked digital identities were discovered.

Gain deeper insights on hacked online credentials by obtaining the free BULIDSEC Digital Identity Anti-Theft Report for May, 2019.

Get your free copy now at:

BULIDSEC EMAIL IDENTITY GUARD The largest data breaches of all time

The Largest Data Breaches of All Time

Trust is good, but control is even better

Identity theft is at an all-time high. Not even the large, well-known online services seem to be immune to hacks, as recent data breaches at Reddit, Twitter and LinkedIn show. In this blog post, we will take an in-depth look at some of the largest data breaches of all time and find out how to make sure cyber criminals don’t take advantage of your data.

The Leaked Online Identity Problem

Your online digital identity is only as safe as the protection measures of the services you trust. Unfortunately, users are discovering time and time again that their trust is betrayed. Some services are simply not big enough to be able to invest time and budget in cyber security. And even for those that do, there is no hacker-proof business model. Some online services claim they provide secure services, but there is always a chance of an undiscovered loophole or a component that can be hacked by savvy cyber criminals.


Case 1: Reddit Data Breach

While many of the well-known online services spend a considerable chunk of their budget on preventing hacks from happening, at the same time they are also a very attractive target for cyber criminals. The more popular an online service is, the more valuable its data are . Case in point: Reddit, a social media platform with over 300 million users, was targeted earlier this year. The internal two-factor authentication system was bypassed by unknown cyber criminals, after which they gained access to an internal database backup as well as user passwords. Even though Reddit claims the passwords were salted and hashed (preventing attackers from accessing them directly as plain text), they recommended that all affected users should change their password.

Case 2: Twitter Vulnerability

Reddit is not the only large social media service that got hit by an embarrassing data breach. Earlier this year, Twitter had to admit that a bug had put the data of all of its 330 million users at risk. Even though the service had measures in place to mask passwords by using a hashing algorithm, it turned out a log file displayed all user passwords in plain text. As with the Reddit hack, Twitter also could not guarantee that the passwords would not be abused, recommending a password change to all 330 million victims.

Case 3: LinkedIn Data Breach

Both Twitter and Reddit were forthcoming and transparent: they informed the users who were affected to make sure they had the chance to take countermeasures. Unfortunately, that is not always the case. Professional social network LinkedIn was hacked in 2012. A large number of passwords was stolen, but at the time, the company only published minimal information about what happened. Early reports claimed that 6.5 million accounts were compromised. In 2016, media discovered that actually a staggering 117 million users were affected, some of which were still using the same, hacked vulnerable password for other services, four years after it had been compromised.

The Situation is out of Control

Since mid of December 2018, the situation seems to be not anymore under control. Breaches such as Collection #1 – 773M password megabreach, Collection #2-5 dump leaks 2.2bn usernames and passwords and Breach of ‘’ exposes 763 million records generated extreme fear and uncertainness for many people. However, a deeper analysis of most of the recent data breaches shows once again that the records of a data breach need to be carefully analyzed for fake records and outdated credentials that have been already publicly available.

Effective Countermeasures Against Pawned Digital Identities

Along to the quality of the identity data that becomes public every day, it is crucial to increase the overall awareness about the topic. If even the large, well-known online services cannot guarantee that they protect your digital identity, it is better to take matters into your own hands. Rather than not using the services at all, make sure you enable all enhanced security that they offer, such as two-factor authentication. Take care to choose a strong password  to make sure that cyber criminals cannot take over your identity by simply guessing.

Finally, ensure that you are immediately informed if your digital identity is breached. By using BULIDSEC Email Identity Guard, you are notified if your email address is part of a data breach and the containing record is not a fake, making sure you can quickly take countermeasures to minimize impact.

Trust is good – Control is even better

Many of my daily activities take place online. From buying travel tickets, dating with friends through various social media, weekly grocery shopping, watching TV via Netflix and Co. For my online activities, I always use different passwords in combination with all security-related mechanisms of the individual online services, such as various types of two-factor authentication. Nevertheless, my online identity has been compromised several times. By using BULIDSEC Email Identity Guard, I can now continuously and independently monitor my online identities, and apply the recommended by BULIDSEC measures, when appropriate.
Susan F.

Best Practice for Protecting Email Identities

How to defend yourself against digital identity theft

As ever more services are moving online, your email address is becoming the cornerstone of your digital identity. No wonder that cyber criminals have begun to target email addresses for identity theft, financial fraud and other online crimes. Make sure you know what cyber criminals are up to so you can defend yourself against digital identity theft!

Digital Identity Theft is an emerging threat

In order to make a profit of digital identities, criminals must first get ahold of them. Unfortunately, that is not a difficult feat. Online services are regularly targeted by hackers looking to extract personal data, causing headlines that describe ever larger breaches: “Hackers Stole Personal Data of 2 Million T-Mobile Customers”, “Tens of millions of hacked Gmail and Yahoo Email accounts are being sold on the dark web”, “Every single Yahoo account was hacked – 3 billion in all”, “Twitter advising all 330 million users to change passwords after bug exposed them in plain text”, “Facebook Security Breach Exposes Accounts of 50 Million Users” and even recently “Store of 770m email addresses and passwords discovered after being put on hacking site”. Worryingly, these headlines cover only those breaches that became public. A considerable number of breaches never gets media coverage: either because the organization that was hacked chooses not to publish any information about the hack – or because they didn’t even notice that a hack took place.


The “Dark Web” and Crypto Currencies are an attractive infrastructure for cyber criminals

Having stolen online identities, cyber criminals often turn to the “dark web” to hawk their wares. The dark web has recently gotten a lot of coverage by the media. It consists of forums, online shops and other websites that cannot be accessed as part of the regular internet. Because they are hard to find, dark web forums give cover to all kinds of activities that can not stand the light of day. The combination of such an attractive infrastructure and the development of anonymous currencies such as bitcoin has given rise to a lively market for identity data. Email accounts and other online identities are being sold at low rates  by criminals looking to make a quick profit.

We often set our priorities on comfort and not on cyber security

The risk increases by the fact that many people use the same email address and password to register accounts with multiple online services. For instance, “85% of the millennials admit to re-use credentials across sites and services”. This leads to a major problem if cyber criminals breach one of these services: a security breach at a single online service can mean that hackers immediately have access to your complete digital identity across all services.

The Digital Identity Theft defense strategy

Having your digital identity stolen can be a harrowing experience. Fortunately, there are some measures you can take to prevent identity theft and to limit its impact.

First and foremost, you should make sure that even if your online identity is breached, the associated data are of no use to cyber criminals. For example, make sure that you use a different password on every website. That way, a data leak on a single website does not lead to cyber criminals getting access to all your other online identities.

In addition to using unique passwords, you should make sure they cannot be easily guessed. “1234” and “password” are so easy to guess that even unskilled hackers can gain access to your account immediately. Instead, choose a complex password (a long password containing letters, numbers and other characters) or a passphrase (a combination of words that is easy to remember but hard to guess).

Some websites offer enhanced security measures, such as two-factor authentication using a smartphone or a security token. By enabling such features, hackers cannot login to your account, even if they manage to obtain your user name and password.

Independent Online Identity Monitoring closes the defense gap

Finally, make sure you are notified if your data are breached. BULIDSEC Email Identity Guard monitor data breaches for any signs of your online identity. That way, you can take countermeasures, such as changing your passwords or closing your accounts, before cyber criminals gain access to your accounts.