Hackers are stealing more information than ever before. These 4 measures protect you

Massive data leaks and breaches are accelerating at an ever-increasing rate – just last month we learned that a few billion records were lost through National Public Data, another few million through Medicare, and 100 million through MC2 Data. Companies that provide background checks and other data processing services simply do not protect the sensitive data that slips through their fingers.

Unfortunately, we, the public, must bear the brunt of the consequences in the form of increased risk of fraud, identity theft, account takeovers and other schemes designed to steal our money.

But you don’t have to expose yourself to such attacks – at least not completely. They can make it harder for criminals to steal from you. Because your time is just as valuable as your money, and trying to recover from a successful scam can cost you both.

Make your login methods stronger

The more passwords leak onto the Internet, the easier it becomes for hackers to guess your password. Not only can they feed this data into their cracking tools, but they can also use the passwords for credential stuffing attacks – that is, injecting known email and password combinations on the Internet to see which accounts can be accessed.

So you need at least strong and unique passwords to protect your accounts. (A password manager can help you keep track.)

Chris Hoffman/IDG

Chris Hoffman/IDG

Chris Hoffman/IDG

But even a good password can’t keep out intruders if someone finds out or guesses it. You really want stronger protection – and that’s where two-factor authentication and/or passkeys come into play.

Two-factor authentication (2FA) creates a second hurdle that hackers must overcome before account access is granted. The most common method for 2FA is an app that generates a one-time code. However, an even safer method is a hardware dongle like a YubiKey. Since it is a physical item, someone would have to have it in their possession to use it.

(Note: You can use codes sent to you via email or SMS for 2FA, but these are weaker methods as SMS and emails can be intercepted.)

Alternatively, you can skip all passwords and use passkeys instead. This newer login method is more secure than passwords and less burdensome than 2FA. Because passkeys are encrypted and tied to both the device and the website they were created for, they cannot be stolen through phishing or used like a password on the Internet. For additional protection, also authorize use of the passkey through biometric or PIN authentication.

WABetaininfo

WABetaininfo

WABetaininfo

I now recommend a passkey as your primary login method, if available, as long as you use a system that secures it. Apple and Android phones automatically sync passkeys between devices, as do password managers that can store passkeys. If you don’t trust the cloud, consider setting up more than one hardware dongle as a passkey device. You can also leave a very strong password + 2FA to your account as a backup login method in case you lose your device and cannot access an alternative device with synced passkeys.

Transitioning all of your accounts to more secure logins may take some time. So at least tackle your most sensitive accounts first, such as those related to finances, taxes, and your primary email accounts.

Lock down your financial life

The data lost through breaches and leaks includes personal information – and not just full names, dates of birth and addresses, but also Social Security numbers of US citizens, putting them at high risk of identity theft. To protect yourself, consider the following measures:

• Block your credit
• Check your credit report
• Freeze your bank report
• Set up an IRS Identity Protection PIN

For more step-by-step information, see our complete overview of how to stay safe if your personal information is found on the dark web. However, this list summarizes the basics for US citizens – and can serve as topics to consider if you live elsewhere. You want to freeze your credit and banking reports so only you can open accounts in your name, check your existing credit report for fraudulent activity, and set up an Identity Protection PIN with the IRS so only you can file a tax return in your name.

PCWorld

PCWorld

PCWorld

If everything goes smoothly, it shouldn’t take you more than half an hour per step – meaning most people can easily complete these steps over the course of a week.

You’ll then need to keep track of your PIN numbers to temporarily unblock your credit or bank profiles and file your taxes. You can use a password manager to store these securely. If you are worried about someone violating your service, you can opt for a locally saved file. (Or you can split the difference and use a database file stored in a cloud account at a large company with robust security teams like Google, Apple, or Microsoft.)

Be careful who you talk to

At this point, the Dark Web is full of personally identifiable information about most of us, meaning criminals can easily create personalized scams. Not only do they know details like your name and where you live, but also the websites and services you’ve signed up for.

Therefore, review all your communications carefully – and be cautious about anything that is of high urgency. Maybe your package really is lost, your credit card actually has suspicious activity, or your brother really lost his wallet while on vacation. You still have time to find out if the message is legitimate, as security experts recommend.

PCWorld

PCWorld

PCWorld

For example, if your credit card has been compromised, do not click on the links in the email or text message informing you and do not provide any personal information to the caller. Instead, you should contact your bank using the contact information listed on your credit card or their website and follow up that way.

If you’re instead trying to review the communications of a person you know rather than a company, the same rules apply. For phone calls, call him back on the known line (as incoming phone numbers can be spoofed). For messages via email, SMS, or other communication platforms such as Messenger, try another alternative if the account has been hacked. (Example: If you receive a request for a quick transfer via Messenger, try calling or texting them to confirm that their account has not been hacked.)

In this new hellscape of digital privacy, trust can no longer be something that comes automatically – especially with the increasing use of AI for even more sophisticated scams.

Stay up to date with the news

To avoid personalized scams, it’s helpful to know what other data breaches and leaks have occurred. For example, AT&T subscribers who are aware that the company has lost customer information (including Social Security numbers) may review communications related to their accounts more carefully.

PCWorld

PCWorld

PCWorld

You can keep up with news in a variety of ways – and in general, you should rely on more than one source, as no service always reports the same events, let alone on the same schedule. Here are a few to consider:

• Broadcast and online media (including PCWorld): These media outlets generally report on serious violations as well as those relevant to their core audience
• Google: If you have an account, you can access the company’s dark web monitoring service, which can report new leaks or breaches surprisingly quickly
• Antivirus suites: Paid subscriptions often include dark web monitoring, while free subscriptions sometimes report when basic information about you (email, name) has been leaked

As always, keep an eye out for email updates from the companies and services you do business with. Often emails or written communications will contain details of the lost information and the remedies offered. However, you should back up the details with news reports to ensure that the message you received is trustworthy.