Yet another reminder to always change your password after a company reports a data breach
A new study by academics from Carnegie Mellon University’s Security and Privacy Institute (CyLab) has revealed that only a third of users actually change their passwords after a data breach announcement.
The study, titled “(How) Do People Change Their Passwords After a Breach?”, is not based on responses from survey participants but on their actual browser traffic. To compile their study, the academics analyzed real-world web traffic collected by the university’s opt-in research group Security Behaviour Observatory (SBO) which collected the full browser history of those who signed up for the purpose of academic research.
The research team then used information collected from the home computers of 249 participants between January 2017 and December 2018. This dataset not only included web traffic but also the passwords used to log into websites and those stored in participant’s browsers.
- This is the best password manager for SMBs in our opinion
By analyzing this data, the academics found that only 63 of the 249 users had accounts on breached domains that had publicly announced a data breach during that time. According to CyLab, only 21 (33%) of these 63 users visited the breached sites in order to change their passwords. To make matters worse, of these 21 users, only 15 changed their passwords within three months after the data breach announcement.
As the SBO also captured the user’s password data, the CyLab team was able to analyze the complexity of the users’ new passwords.
The research team revealed that of those who changed their passwords, only a third changed them to a stronger password. The rest of the users created passwords of weaker or similar strength and many reused character sequences from their previous password or used passwords that were similar to their other online accounts.
While the study shows that users are still not receiving proper education when it comes to password security, the researchers argue that the hacked services are also to blame as they rarely tell users to reset their similar or identical passwords on their other accounts.
If your business needs help keeping home workers safe
take a look in the Cyber Security area of our website