In this presentation, Robert Siciliano outlines the staggering scale of recent data breaches—27 billion records exposed in the first half of 2020, over 40 billion in 2021, and an estimated 146 billion by the end of 2023. He explains that this exposed data includes personal identifiers, financial details, usernames, and passwords, putting millions at risk. Siciliano then downloads a real‑world credential dump containing 21 million unique passwords, demonstrating how many users still rely on trivially simple passwords (e.g., "1", "2", "I‑LOVE‑SEX"). He describes credential‑stuffing attacks, where attackers automate the use of these leaked credentials against popular services such as PayPal, Amazon, and Gmail. Finally, he advises practical defenses: making stolen data useless through strong, unique passwords, multi‑factor authentication, continuous monitoring services, and adopting a mindset of becoming a tougher target rather than fearing the breach.
Chapters
27 billion records exposed in the first half of 2020. All right? 27 billion. Further, more than 40 billion records exposed in 2021. It gets worse. 146 billion digital records will be stolen by the end of 2023. What does all this mean? It means that your name, your address, your phone number, Your account numbers, credit card numbers, bank account numbers, your usernames and your passcodes, your email addresses, your mobile phones, your Social Security numbers are in the hands of criminals. Yeah. So what do you do about that? Do you worry about it? Do you freak out about it? Do you go underground? Do you just use cash? None of that stuff. The idea is to make the data useless to the thief. It's understanding risk, putting it into perspective, and knowing that making small little changes, putting systems in place, having certain monitoring services to watch your back, then you can essentially make the bad guy's job that much harder. Again, there always has been, there is, and there always will be this criminal element out there. Your job is to become a tougher target. An astonishing 773 million records exposed in a monster data breach, including 21 million unique passwords recently posted to a hacking forum. So check this out, right? This is that database. These are those records, right? You see 1.5 million combos, 1.25 million combos, 100,000 K— 100K email pass high quality, 142K fresh HQ private combos, right? That's 21 million credentials. Okay, and guess what? Those credentials are right here on my device, right? I have them. I decided to download them. I wanted to check it out. I wanted you to see it. I want you to understand how your data is out there and what it looks like. So that information, for example, 1.5M combo Email passcodes. Here we have a text file and there you see absolute raw data. Andre K. Rigby at Gmail, this is passcode. Tyler Perrin at Gmail, this is passcode. Dafine at Gmail, there's her passcode. Your data is likely included in these files, right? I do a quick search to see what people are using for passcodes, and you'd be amazed at how simple human beings are. We do 1, 2, 3, 4, 5, 6, and it shows that 11,794 people out of 1.5 million are using 1 through 6 as a passcode. Alright? So they're making it really easy for the bad guy just to access their accounts. Further, I always think this one is kind of funny, I type in I-L-O-V-E-S-E-X and 11, let me see, 26 people apparently love sex as their passcode. So Karen, and of course we all know a Karen, loves sex as her passcode. Now bad guys know that all you need to do is access the dictionary and you use what's called a credential stuffing attack. It's software that's easily downloaded that has access to all of all of these credentials, and what the bad guys do is they stuff your credentials into known— into the software into known websites. So Expedia, PayPal, Visa, MasterCard, American Express, eBay, Amazon, Gmail, Hotmail, AOL, Yahoo, and they just log in. So today we talk about hacking, you know, when people think about hacking they think it's mystical, they think it's Harry Potter, waving a wand, but really it's computer science. And once you understand the fundamentals, once you understand the basics, it's really not that difficult. And when the data is out there, when our information is exposed like this, it makes it that much easier for the bad guy to get inside the network and exploit you, exploit your clients, exploit your company's data.
