In this interview, hosts introduce alarming statistics that nearly half of U.S. adults and 432 million online accounts have been compromised in the past year. Security experts Robert Siciliano (McAfee) and Mark Rasch (cyber‑privacy specialist and former DOJ prosecutor) explain why the breach problem is so pervasive. They describe the full spectrum of threat actors—from teenage hobbyists to organized crime groups and state‑sponsored advanced persistent threats—highlighting the financial motive behind attacks. The conversation covers the breadth of recent high‑profile breaches (Target, Adobe, Snapchat, AOL, eBay) and notes that while many jurisdictions mandate breach disclosure, the real challenge is prevention. Both experts stress that every individual is a potential victim, from newborns (whose Social Security numbers can be misused) to deceased persons, because unsecured home devices can serve as entry points to corporate networks. They outline practical defenses: antivirus/anti‑spyware, firewalls, VPN‑secured Wi‑Fi, strong and unique passwords, secure password managers, and two‑factor authentication. Rasch adds that breaches often go undetected for long periods and compromised machines may be co‑opted into botnets without the owner’s knowledge. Siciliano concludes on a cautiously optimistic note, noting growing consumer adoption of two‑step authentication and better security awareness, but warns the battle remains a race between attackers and defenders. The dialogue ends with the hosts thanking the guests.
Chapters
All right, here's an alarming figure. I shared it right before the break, that nearly half of all adults in the U.S. were hacked within the last 12 months.
Half of us. This is according to some new research that includes the mind-boggling find that 432 million online accounts were also hacked in the last year. So not just, you know, the people, but the accounts specifically.
Yeah, and let's look at it this way. Basically, there's a 50% chance that a cyber criminal a criminal has or had access to your personal information. We're talking your name, your physical address, credit card numbers, passwords, anything.
So let's talk about this with Robert Siciliano, uh, uh, McAfee online security expert, and Mark Rasch, a cyber and privacy expert and a former Justice Department prosecutor, by the way, for cyber crimes. Gentlemen, we're so glad that you're here. Thank you. Robert, I want to start with you.
Good morning.
Um, A lot of people are sitting at home going, how is this happening?
Yeah, yeah, we're all asking that same question. The fact is you have troves of data that's being housed by corporations and government agencies that essentially is a big target. That data, like credit card information, Social Security numbers, usernames and passwords, could be used to access existing accounts and taking over those existing accounts or be used to open up new lines of credit. So it's very attractive to thieves, and corporate IT managers are under the gun every day to protect that information.
You know, Mark, some people might have in their mind this image of, you know, a 19-year-old sitting in his basement with a laptop and he's doing all this. But these are in some cases very sophisticated networks. Sometimes— indictment of the Chinese officials just a few days ago What should we be looking for, and give us an idea of who these people are?
Well, the threats come from all over. They do come from these 19-year-old, 20-year-old young hackers. They come from organized groups of hackers. They come from organized crime. But the big threat here, or what we call the advanced persistent threats, come from state-sponsored attacks by countries like China, Russia, former Soviet republics, and things like that. So, you know, it's the old Willie Sutton theory. Why are they going after my accounts? Why are they going after my information? Why are they going after my computer? And the answer is, that's where the money is.
Okay, so let's talk about the list because it's long and it just keeps getting bigger. Target, Adobe, Snapchat, AOL, eBay. Those are some that have been hacked just in the last 12 months. Um, but a lot of companies, I understand, aren't exactly transparent, uh, about their data breaches. Uh, did— should companies be, you know, forced to be more transparent about what's happening?
Well, you know, there's— there are laws in almost every jurisdiction that require companies to report certain kinds of data breaches. So data breach that involves personal information like name, address, account number, PIN number, those types of things, they're required already under the law to report. But You know, every company, every company that's doing business online is being attacked constantly. And in fact, even individuals, your mother, your grandmother sitting at home with a wireless router, they're being attacked constantly as well. And the problem isn't that it's not being reported, it's that it's not being prevented. And it's a very difficult thing to do.
So Robert, you know, I find that companies nowadays kind of force you to become part of this. You've got to get an online sign-in. You've got to use a card in some places. Is there any person, any profile that is more vulnerable than another?
Yeah, that's a good question. The, uh, fact is, uh, from birth, uh, you are given a Social Security number today, and that primary identifier can be used to open up new lines of credit under a baby's name. So even a child, uh, can be a potential victim, all the way to somebody who has passed. The deceased are also vulnerable to identity theft as well, which is crazy. But, uh, we're all potentially victims, and the path of least resistance to get into these big servers is now going through your PC. So like it was previously said, that unsecured wireless connection that you have to the internet may be the direct access to your bank's online account, whereas your bank might be spending millions a year— millions yearly— to protect their networks. Again, your unprotected local PC could then be that path. So we all have to take responsibility to protect our devices, our mobiles, tablets, our laptops and desktops with antivirus, anti-spyware, anti-phishing firewalls, making sure that our wireless is locked down with a VPN, and then, you know, changing up your passwords, secure password management, uppercase, lowercase, using characters, and not having the same password for all your critical accounts. Changing up your passwords is essential.
But that's so much.
I know, I know, we've already been talking about how I've got like 17 different passwords for things. The head of Paramount Institute said, and this is a quote here, "If you're not a data breach victim, you're not paying attention." So it made me wonder, how much time, Mark, goes by where you have been hacked and you don't know it?
Well, a lot. I mean, one of the things is, One of the problems is you don't even have to have a personal computer or even be online to be a data breach victim. As long as information about you is being held by somebody, that data is at risk. And what the hackers want to do is they want to get that personal information and either steal money from your credit cards or become you, so open a new identity, or sell your data to somebody else. And there's a long lag time between the time they make a breach and the time that they may then exploit exploit what they've used for the breach. And the other thing is people will break into your computer and use that as what's called a robot network or botnet to try to go after other people's computers as well. So somebody may be being attacked in Montana and it's coming from your computer and you know nothing about it.
Robert, make me feel better. Um, are we going to go down the road where this is going to get worse, or potentially are we at the cusp of figuring this out and protecting our information?
So what's happening right now is, um, there are, uh, developing technologies, technologies already in place that consumers are beginning to adopt that, um, uh, work towards securing them and the corporations which they do business with. Two-step authentication, two-factor authentication, where you might be provided an additional one-time password via a mobile text with, uh, companies like Google and Facebook and Twitter. PayPal offers it, Apple offers it, and as consumers get more savvy to use these additional second factor forms of authentication, it makes them and the corporations they're doing business with that much safer. They're also getting better at password management as in general and understanding the fundamentals of information security. So as consumers become more aware, as they up their security intelligence, as banks and major corporations tighten up, we begin to be more secure, keeping in mind that the bad guys are also getting better at their jobs. So it is a race to the finish.
Wow.
All right. I feel a little better. All right. Thank you, Robert Siciliano, Mark Rasch. Good to have both of you this morning.
