International operation shuts down the LeakBase forum

An international law enforcement operation led by Europol has shut down the LeakBase forum and seized its data. The forum was one of the largest known marketplaces for buying and selling credentials and payment data such as usernames, passwords and card numbers. At the time of the takedown the site had more than 142,000 registered users. The operation took place on 3 and 4 March and included measures against 37 of the most active users.

What this means for your business

Takedowns remove a marketplace but not the data already traded on it. Stolen employee credentials are often the front door in serious incidents, and a password sold last year still works if it has not been changed. Organisations should use the occasion to check their own exposure rather than file the story away as a win for law enforcement.

Berigo recommends

• Monitor whether your email domain appears in known leaks, and follow up with forced password resets for affected accounts.
• Require multi-factor authentication on every internet-facing service, with no exception for administrator accounts.
• Block reuse of known leaked passwords in your directory service.
• Review dormant accounts that have not been used for a long time and close them.

Source

• europol.europa.eu
• justice.gov