LONDON–Personal information on 5.5 million employees from the world’s 1,000 biggest public companies has been discovered online by a British cyber security firm that searched through data compromised by recent breaches of popular websites, according to the Financial Times.
Digital Shadows found details including corporate email addresses and passwords from 97% of the 1,000 companies. The firm did not name the individual companies concerned, according to the Times.
The Financial Times said Digital Shadows trawled through data leaked from popular services such as LinkedIn, Dropbox and MySpace, looking for users who had signed up using their work email accounts. Many of those individuals simply reused their work passwords, the company said.
The Financial Times said much of the data uncovered by Digital Shadows had not been previously leaked — 90% of the 5.5 million usernames and passwords were newly available online.
“We were analyzing leaks going back to 2012, so I thought we would see a lot of duplicates, but only 10% of credentials had been in previous leaks,” Rick Holland, vice-president for strategy at Digital Shadows, told the Financial Times. “Whenever a breach becomes public, the first thing our clients ask is: ‘Are these details new or repackaged?’ So this is bad news.”
The Times quoted another cybersecurity expert as saying there’s an even bigger threat developing in the world of online personal information.
“One frightening example is the ‘Facebook of Everything’ that China’s intelligence service is compiling from the personal data stolen over several high-profile U.S. cyber breaches,” Robert Capps, vice-president of business development at NuData Security, told the Financial Times. “Their stated goal is to compile it into a massive Facebook-like network to build a profile of everyone, with more details than Facebook.”