iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Gen Digital, owners of what used to be Symantec, has begun notifying NortonLifeLock customers that its Norton Password Manager has been breached.
Using account details from other sources, the hackers used a credential-stuffing attack that has compromised a number of accounts.
In a notice to the Vermont Attorney General in the United States, NortonLifeLock admits that it noticed “an unusually large volume” of login attempts, all of which failed, on 12 December 2022. The company completed an internal investigation on 22 December, wherein it discovered that a number of accounts had been accessed.
The very first use of an illegally acquired username and password being used dates back to 1 December.
“In accessing your account with your username and password, the unauthorised third party may have viewed your first name, last name, phone number, and mailing address,” NortonLifeLock said in its notice.
NortonLifeLock went on to warn customers to use two-factor authentication to keep their accounts secure, and offered victims the use of a credit-monitoring service.
In a later statement to Bleeping Computer, Gen Digital said that only a small percentage of its 500 million customers were affected.
“We have secured 925,000 inactive and active accounts that may have been targeted by credential-stuffing attacks,” a Gen Digital spokesperson said.
“Systems have not been compromised, and they are safe and operational, but as is all too commonplace in today’s world for bad actors to take credentials found elsewhere, like the dark web, and create automated attacks to gain access to other unrelated accounts.”
Gen Digital continues to monitor affected accounts and is actively notifying customers to reset their passwords at the earliest opportunity.
Ironically, when Norton released its last quarterly Consumer Cyber Safety Pulse Report, it warned that 2FA was not the be-all-end-all solution many consider it to be.
“Cyber criminals have become experts at catching one-time codes used in most two-factor authentication and they know that by undermining the systems that send the codes, their efforts are even more effective,” Jeff Nathan, technical director and researcher at NortonLifeLock, said last September.
Instead, he recommended customers use FIDO U2F tokens wherever they can.
Sounds like good advice.
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
