Over the last decade, the gig economy boom has allowed professionals worldwide to switch to freelancing and build a network of international clients.&nbsp;
According to Upwork, 1 in 3 US workers engaged in freelance work during 2020. Some of the most successful freelancers earn hundreds of thousands of dollars per year through platforms like Upwork, Freelancer, and Toptal.
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
Does your company hire freelancers? How do you <a href="https://teampassword.com/blog/should-i-share-data-with-freelancers">share passwords with freelancers</a>? TeamPassword is an affordable password management solution for small businesses, startups, and agencies to share credentials securely with team members and freelancers. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> today.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h2>10 Successful Freelancers</h2>
Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in their given field with excellent track records&mdash;many have worked with the biggest companies in the world!
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>1. Scott Luscombe - Graphic Designer / Shopify Expert / Website Developer / Copywriter&nbsp; - Canada</h3>
Scott Luscombe is a freelance graphic designer, Shopify expert, website developer, and copywriter from Uxbridge, Canada. He holds a degree in Illustration from Sheridan College and a degree in Marketing from the University of Toronto.
Scott has been a freelancer for most of his professional career and has earned over $500k on Upwork. He has completed over 311 jobs and worked&nbsp;10,956 hours!&nbsp;
Scott's work includes graphic design and branding, illustration and icons, copywriting, website design and development, UX/UI, and printing and packaging. He also provides freelance coaching and consulting. Scott is a Top Rated Upwork Freelancer currently charging $99 per hour for various creative gigs.
Some of Scott's most notable work includes designs for Coca-Cola, the Canadian Cancer Society, Nickelodeon, and Wallet Ninja (to name a few).&nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>2. Kathy Edens - Marketing Consultant / Freelance Copywriter - United States</h3>
<a href="https://www.upwork.com/freelancers/~016177d19f0624c1a7?viewMode=1">Kathy Edens is a Top Rated Upwork Freelancer</a> with over $300k platform earnings! Kathy has been self-employed as a marketing consultant and freelance copywriter for almost ten years from her home in Ohio, United States.
She holds a Bachelor of Science in Professional Writing and Psychology from Oregon State University, which she says "...helps me understand how to reach your target audience with words."&nbsp;
Kathy has ghost-written several non-fiction books on various topics, including social entrepreneurship, healthcare, real estate investing, and the cannabis industry, to name a few.
Kathy also writes web content, sales pages, email marketing content, case studies, white papers, brochures, press releases, and more. Kathy's rates start at $86 per hour for her writing and marketing services.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h3>3. Koen van Oeveren - UX designer - Netherlands</h3>
Koen van Oeveren is a freelance UI &amp; UX designer from North Brabant, Netherlands, with almost ten years of experience. Koen works with several design agencies in the Netherlands, designing apps, websites, and eCommerce experiences for many international brands.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
Koen holds a Bachelor of Applied Science in Communication and Multimedia Design from Avans University in the Netherlands. Koen's <a href="https://www.koenvo.com/index.html">portfolio website Koenvo</a> was nominated for a <a href="https://www.awwwards.com/sites/koenvo-ui-ux-portfolio">2021 awwwards. Award</a>.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h3>4. Pascal Strasche - Product / UX designer - Germany</h3>
Pascal Strasche is a product and UX designer with more than ten years of design experience from Germany. He holds a Master of Arts in Interaction Design and a Bachelor of Arts in Graphic Design, both from HAWK University of Applied Sciences and Arts.
For almost a year over 2020/2021, Pascal worked as the sole product designer to design Con Cubo's SaaS tool that helps complex organizations visualize and manage teams. He's also worked with German steel giant XOM Materials to find product solutions to digitalize&nbsp;Germany's steel industry.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
In 2019, Pascal founded Product Design Resources, a growing archive of 800+ design resources, weekly updated for the design community.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>5. Paul Hunkin - Developer - New Zealand</h3>
Paul Hunkin is a freelance software consultant and developer from Tauranga, New Zealand, but currently living in Portugal.&nbsp;
Paul has over ten years of experience as a software developer with an impressive work history, including Google, NASA, InfoSys, and the Chinese aerospace industry leader COMAC.
He's worked with several early-stage startups designing everything from high-performance big-data systems to complex web applications to 3D rendering engines. He's also built a lot of the foundational code for independent games on Android.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
Paul is a Top Rated Upwork Freelancer with over $400k in platform earnings. His rates start at $120 per hour for software development. <a href="https://paulh.consulting/">Check out Paul's website</a> for more about his impressive portfolio and work history.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>6. Jana Galat - Writer / Brand Strategist - Canada</h3>
Jana Galat is a freelance copywriter and brand strategist from Ontario, Canada. She holds a Bachelor's Degree in Management and Organizational Studies from King's University College and an Honors in Business Administration from Western University.
Jana has extensive experience writing landing pages, email campaigns, social media ads, and print materials and says, "I am obsessed with creating copy that sells..."
After several years of professional work experience, Jana went freelance in 2019 and has quickly built a reputation as a <a href="https://www.upwork.com/freelancers/~01bfa17a48301876dd">Top Rated Upwork Freelancer</a> with over $70k in platform earnings. Jana's rates start at $100 per hour for copywriting and brand consulting.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>7. Kate H. - Logo Designer / Branding Expert - United States</h3>
Kate is a freelance professional logo designer and branding expert from Maryland, United States. Kate&nbsp;ran her own green wedding brand which she sold to mywedding.com in 2014, allowing her to focus on helping small&nbsp;businesses figure out what they want (and who they are) and translate that into design.
She holds a Master's degree in Environmental Management from Yale School of The Environment, and a J.D. in environmental law from Pace Law School.&nbsp;
Kate's skillset includes redesigning and updating material to make it easier to understand, building a consistent brand from a simple starting point like a logo, and creating unique logos that guarantee results.
Kate is a Top Rated Upwork Freelancer, and her rates start at $225 per hour. You can find out more about Kate on her <a href="https://www.upwork.com/freelancers/~013ce73876c1c18126" rel="follow noopener" target="_blank">Upwork profile</a>.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>8. Marcos Rezende - UX designer - Canada</h3>
Marcos Rezende is a UX Designer from Ontario, Canada, with more than 13 years of experience. Marcos has worked in over 30 industry sectors for multinational organizations in the United States, Canada, Germany, and Brazil.&nbsp;
Some of Marcos' notable projects include apps for Ontario's COVID-19 dashboard, Urban Master Planning collaboration platform, and Reaction (kid's e-learning app), to name a few.&nbsp;
Marcos loves sharing his industry expertise with aspiring UX designers and regularly writes for the popular UX publication Career Foundry. Total recognizes Marcos as part of its "Top 3%" of global freelancer talent&mdash;a title given to elite freelancers in their given field.
We don't have access to Marcos' rates, but the best UX designers on Upwork earn upwards of $100 per hour. As a Toptal Top 3% freelancer, Marcos likely charges $200-$300 per hour.
<a href="https://www.marcosrezende.com/">Marcos Rezende's website</a> was nominated for the prestigious <a href="https://www.awwwards.com/sites/ux-portfolio-marcos-rezende">awwwards.</a> in 2021.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>9. Tanya Litvinova - UX/UI Designer - United States</h3>
Tanya Litvinova is a freelance UX/UI designer from New York City, United States. She holds a Bachelor of Fine Arts in Advertising Design / Communication Design from the Fashion Institute of Technology.
Tanya specializes in product, mobile, and web design as well as user experience flow, research, and validation.
"I have a passion to make the complex simple, shape behavior, design, plan, and strategize. Aiming for the best user experience, all the while balancing the needs of business and technology to create engaging, habit-forming digital products."
Tanya has worked with Fortune 100 &amp; Fortune 500 companies and successfully delivered business-transforming data-driven analytics, responsive BI dashboards, enterprise web apps, and management systems. Some of Tanya's notable clients include KOCH Industries, BlackRock Financial, BCG Group, and FireEye, to name a few.
<a href="https://www.upwork.com/freelancers/~0165035041b26e96df">Tanya is a Top Rated Upwork Freelancer</a> with more than $200k platform earnings. Her current rate starts at $162.50 per hour.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<h3>10. Guangming Lang - Data Scientist - United States</h3>
Guangming Lang is a freelance data scientist from Michigan, United States. He holds a Bachelor of Arts in Mathematics from New College of Florida and a Master of Science in Biostatistics from the University of Michigan. Guangming has also completed several Coursera courses in data science and machine learning.
Guangming has been a freelancer since 2013 and has worked across several industries, including fintech, trading, medicine, biotech, advertising, and HR.&nbsp;
Guangming is a Top Rated Upwork Freelancer with over $400k in platform earnings. He's completed 216 jobs on Upwork totaling 3,805 hours! Guangming's current rates start at $200 per hour.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
<h2>Secure Freelancer Workflows With TeamPassword</h2>
No matter how talented or reputable the freelancers and contractors you hire, your company must use secure workflows to protect your digital assets.
Freelancers often need access to shared accounts and tools. Using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a> is the first step to securing these accounts and platforms. You can also use a password manager to share credentials with employees, clients, and other stakeholders to ensure you never expose raw passwords via email, spreadsheets, chat apps, and other non-secure methods.
<a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> lets you create groups to share access with only those who need it. When they're done, revoke access with a single click. No need to change passwords every time someone leaves the team.
If you do need to change a password, TeamPassword's built-in <a href="https://teampassword.com/password-generator">password generator</a> lets you create secure passwords between 12-32 characters using numbers, letters (uppercase/lowercase), and symbols.
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
Ready to onboard clients and freelancers securely with TeamPassword's robust <a href="https://app.teampassword.com/dashboard#signup/testimonial">password management solution</a>? <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a free trial</a> to secure your company's digital assets today!

Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in their given field.

Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in ...

10 extremely successful freelancers and what they do

Here are ten successful freelancers and what they do. These freelancers have earned their place as experts in their given field with excellent track records—many have worked with the biggest companies in the world!

<h2>What Is a Brute Force Attack, and Are You at Risk?</h2>
&rlm;&rlm;&lrm; &lrm;
A brute force attack is when hackers use trial and error to guess login credentials, encryption keys, or some other hidden information. Hackers essentially work through all possible codes of characters in order until one of the combinations works.
The attack is called &ldquo;brute force&rdquo; because it is just an unsophisticated use of login attempts to get into an account. It is essentially an overwhelming attempt to &ldquo;force&rdquo; one&rsquo;s way into a secured location.
This is one of the oldest forms of attacks, but it is still popular today. It can take anywhere from seconds to longer than the age of the Universe to crack a password using this method depending on the complexity of the chosen password and the amount of cloud computing resources put to use in the attack.
To prevent brute force and related attacks, you need to ensure your team is using long, complex, and random passwords. This is best accomplished using a password manager.&nbsp;
<a href="https://teampassword.com/">TeamPassword</a> keeps all your passwords safe and up to date so that they are there when you need them.
TeamPassword lets you safely share passwords with teammates while ensuring that your projects are safe.
&rlm;&rlm;&lrm; &lrm;
Sign up today for a <a href="https://app.teampassword.com/dashboard#signup/testimonial">free 14-day TeamPassword trial</a> and protect your company's digital assets from cybercriminals.
&rlm;&rlm;&lrm; &lrm;
<h2>Types of brute force and related attacks</h2>
While the traditional brute force attack is unsophisticated and relies on cycling through all random combinations of permissible characters, meaning that the word &ldquo;password&rdquo; is equally safe (or not safe) as the combination &ldquo;aT./$x6m&rdquo;, in practice, brute force attacks are modified or combined with others making <a href="https://teampassword.com/blog/colonial-pipeline-ransomware-attack-dont-reuse-passwords">reused</a> or common passwords far less safe. The following are some of the brute force and related attacks used today:
<ul>
<li style="font-weight: 400;" aria-level="1">Simple brute force attacks</li>
<li style="font-weight: 400;" aria-level="1">Dictionary attacks</li>
<li style="font-weight: 400;" aria-level="1">Hybrid brute force attacks</li>
<li style="font-weight: 400;" aria-level="1">Reverse brute force attacks</li>
<li style="font-weight: 400;" aria-level="1">Credential stuffing</li>
</ul>
<h3>Simple brute force attacks</h3>
The simple brute force attack simply cycles through all possible passwords in order. As an overly simple example, if your login information allows only lowercase, six-digit passwords, then it would start at &ldquo;aaaaaa&rdquo;, go to &ldquo;aaaaab&rdquo;, and so on until hitting &ldquo;zzzzzz.&rdquo;
<h3>Dictionary attacks</h3>
Dictionary attacks are often used as the prelude to a brute force attack. They are not brute force attacks themselves, but in combination with a brute force, attack make it far more likely that the brute force attack will succeed.&nbsp;
In these attacks, the hacker first tries all words in a dictionary. These dictionaries include not only the words you&rsquo;d find in the Merriam-Webster dictionary but also variations of the words and lists of commonly used passwords as well. For example, instead of just &ldquo;password,&rdquo; you&rsquo;d find &ldquo;Password,&rdquo; &ldquo;p4ssw0rd&rdquo;, &ldquo;Pa55W0rd123&rdquo;, and so on.&nbsp;
This is why both complex and unique passwords are needed.
<h3>Hybrid brute force attacks</h3>
The hybrid attack is the mixture of the simple brute force attack and dictionary attack mentioned above. They are particularly good at finding common passwords that have been mixed with some form of <a href="https://teampassword.com/blog/password-best-practices-what-makes-a-password-strong">padding</a>.
Padding is when you take a password, e.g., &ldquo;Password,&rdquo; and then add a set of random characters to the end, e.g., &ldquo;1.1/1.1/2.2/2.2&rdquo;. While &ldquo;Password1.1/1.1/2.2/2.2&rdquo; is a much stronger password than either half separately, these hybrid systems will run a brute force method for cracking the padding behind common passwords.
<h3>Reverse brute force attacks</h3>
Instead of running through billions of potential passwords, the reverse brute force method uses a common password and then tries to find any account using that password. For example, knowing that the password &ldquo;qwerty&rdquo; is still disastrously common, the hacker will keep using that password while trying to find usernames of people who have unfortunately not updated their password thinking since the last millennium.
<h3>Credential stuffing</h3>
This method works with username-password combinations that have been <a href="https://teampassword.com/blog/have-i-been-pwnd-what-to-do-when-it-happens">pwned</a>. Being &ldquo;pwned&rdquo; means that your credentials have been leaked online.&nbsp;
Since many users reuse their login information on many sites, hackers will check a known password&ndash;username combination across hundreds of other sites in hopes that someone has reused their pwned credentials.&nbsp;
In our quest to become more secure, passwords become less and less easy to remember. This leads to password reuse. Let <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> take care of securely remembering your team&rsquo;s passwords, so they don&rsquo;t use the same passwords as on less secure sites.
&rlm;&rlm;&lrm; &lrm;
<a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a>, so TeamPassword can start protecting your network today!
&rlm;&rlm;&lrm; &lrm;
<h2>Tools that Aid Brute Force Attempts</h2>
It goes without saying that this isn&rsquo;t being discussed to encourage password cracking, but just to see exactly what you are up against when trying to secure a network. Hackers have created an entire ecosystem of tools to aid them in their nefarious actions, and you should be aware of them to appreciate just how hard it is to maintain a secure network.
<h3>Automated tools&nbsp;help with brute force attacks.</h3>
Instead of manually entering every possible password, it is unsurprising that hackers have created automated software to run their brute force attacks. These automated programs can run through dictionary attacks as well.&nbsp;
Many of these tools have workarounds to work against computer protocols (e.g., MySQL and Telnet), hack wireless routers, decrypt passwords in encrypted storage, translate words to different forms (e.g., password, p4ssw0rd, and Pa55WoRd), and identify weak passwords.
<h3>Some tools can scan pre-compute rainbow tables.</h3>
A rainbow table is a pre-computed table for caching the output of cryptographic hash functions, usually for cracking password hashes. Thus, scanning rainbow tables removes the hardest part of the brute force attack to speed up the rate of cracking.
<h3>GPU Speeds Brute Force Attempts</h3>
Brute force attacks require a huge amount of computation. GPUs can do this work much more easily than CPUs, so many brute-force software packages enable the use of GPUs.
<h3>Combining the CPU and GPU&nbsp;</h3>
Combining CPUs and GPUs accelerates computing power even further. GPUs can process parallelizable processes incredibly quickly. That is, any computing process that can be broken down into many smaller components to be run at the same time can be done across the thousands of computing cores in the GPU at a rapid pace. With this method. Hackers can crack passwords about 250 times faster than a CPU alone.
&rlm;&rlm;&lrm; &lrm;
<h2>How effective is a complex password against a brute force attack?&nbsp;</h2>
Brute force attacks can be thwarted by long, complex passwords. However, that doesn&rsquo;t mean you are entirely without vulnerability just because you force users on your network to pick complex passwords.&nbsp;
Let&rsquo;s assume you make everyone on your network choose a password with a minimum length of 12 characters with at least one lowercase letter, uppercase letter, number, and special character. That is, it meets the following requirements:&nbsp;
Lowercase letter {abcdefghijklmnopqrstuvwxyz}
Uppercase letter {ABCDEFGHIJKLMNOPQRSTUVWXYZ}
Number {0123456789}
Character {!@#$%^&amp;*()_+{}|:"&lt;&gt;?~`-=[]\;',./}
This is very effective against a brute force attack: to crack that password by trying 20,000,000,000 attempts per second, which can be accomplished using a cloud computing platform, would take an average of 3,300 years. But is that enough?
Although it would prevent a pure, simple brute force attack, if a hybrid brute force attack were used instead, then it would depend on how unique the password is as well. If your employee chooses the password &ldquo;Password-123&rdquo;, then chances are it will be found in the dictionary prelude to the brute force attack, and a hacker will be on your network in seconds.
&rlm;&rlm;&lrm; &lrm;
<h2>What do hackers gain from Brute Force Attacks?</h2>
Brute force attacks are not cheap. Either the hackers need to own a huge computing service or pay for that server time. Alternatively, they might spend years developing a botnet to carry out the attack. So, where is the payoff? Well, hackers can profit in many different ways:
<ul>
<li style="font-weight: 400;" aria-level="1">Profiting from ads or collecting activity data</li>
<li style="font-weight: 400;" aria-level="1">Stealing personal data and valuables</li>
<li style="font-weight: 400;" aria-level="1">Spreading malware to cause disruptions</li>
<li style="font-weight: 400;" aria-level="1">Hijacking your system for malicious activity</li>
<li style="font-weight: 400;" aria-level="1">Ruining a website&rsquo;s reputation</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2>How can you reduce your risk of brute force attacks?</h2>
There are many ways you can reduce your risk of brute force attacks. Often, just being a difficult target is enough online as there are still people using &ldquo;12345678&rdquo; as their password, and the reduced effort makes them a more profitable target.
<h3>Longer passwords with varied character types</h3>
Whenever possible, use long, complex passwords with lowercase and uppercase letters, numbers, and special characters.&nbsp;
<h3>Elaborate passphrases</h3>
If a site allows you to create passwords of any length, consider a passphrase&mdash;or the combination of many words&mdash;mixed with special characters. For example, instead of &ldquo;H3ll0#&rdquo;, try &ldquo;hello.MY-nAmE/15_what&rdquo;. The sheer length combined with special characters and numbers makes it much harder to crack through brute force or dictionary attacks.
<h3>Stay away from frequently used passwords.</h3>
Passwords need to be complex and unique! One or the other will not fool hackers for even a minute.
<h3>Use unique passwords for every site you use</h3>
It is always worth reiterating: never reuse passwords. If your password is pwned on Fortnight, that might be annoying. If the hackers then use that password to empty your bank account, it goes from upsetting to months or years of misery.
<h3>Remove unused accounts</h3>
Keep your network safe by removing old users regularly and immediately if they have high permissions.
<h3>Use a password manager.</h3>
The best thing you can do to prevent a brute force attack is to help your users create strong passwords by providing a password manager. Only with <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> can you facilitate your team in becoming proactive participants in network security.&nbsp;
&rlm;&rlm;&lrm; &lrm;
<a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> to test TeamPassword with your team members today.

A brute force attack is when hackers use trial and error to guess login credentials. but how can you protect yourself from their attacks?

A brute force attack is when hackers use trial and error to guess login credentials. but how can ...

What is a brute force attack and are you at risk?

Have I been pwned? is the Robin Hood of <a href="https://teampassword.com/blog/category/data-breaches">data breaches</a>. <a href="https://haveibeenpwned.com/">Have I been pwned</a> is a website that sifts through mountains of stolen personal information from data breaches, then organizing everything so users can find out if they're one of the victims!&nbsp;
All you have to do is go to their site, type in your email, and it&rsquo;ll tell you everything the Internet knows about you:
<img src="https://cdn.buttercms.com/l6Gg2HDQvuLJDq0JuwXL" alt="undefined" width="563" height="351" style="display: block; margin-left: auto; margin-right: auto;" />
We have a bittersweet appreciation for have I been pwned?. On the one hand, it's fantastic that victims have a way to discover if they've been pwned, but on the other hand, it saddens us that we need such a service!
Data breaches have increased significantly since 2019. With no signs of decreasing, companies must do everything they can to prevent data breaches. One of the best ways to protect yourself from data breaches is to simply change your password. But with so many passwords required day in and day out, people seldom do.&nbsp;
With a password manager, you can frequently change your passwords and still remember them all.
Using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">robust password manager like TeamPassword</a> makes it easy to share credentials with team members while preventing attackers from accessing your company's digital assets.
&rlm;&rlm;&lrm; &lrm;
<h2>What is the site "have I been pwned?" - haveibeenpwned.com</h2>
have I been pwned? is a web service that collects and organizes personal information from data breaches. Users can enter their email or mobile number on the home page to find out if they're among the victims.
The service is free, but there is an option to <a href="https://haveibeenpwned.com/Donate">donate to have I been pwned?</a>&mdash;something we encourage people to do! have I been pwned? provides a valuable service that government agencies should have done a long time ago!
With the looming fear of <a href="https://teampassword.com/blog/extortion-emails-what-they-are-how-do-they-happen">extortion emails</a> from the Ashley Madison breach in 2015, users flocked to have I been pwned?&mdash;resulting in a 57,000% increase in website traffic!
Security firms and government agencies encourage businesses and individuals to use the service to stay ahead of possible cyber attacks.
Today, have I been pwned? gets over 165,000 daily visitors, has an email list of over 3 million subscribers, and a database of almost 10 billion compromised accounts!
<h3>pwned? That's a Funny Name!</h3>
Pronounced poned (with a hard "p") pwned originates from the popular game Warcraft back in the early 2000s. The game's developers misspelled owned as pwned.&nbsp;
Gaming enthusiasts and Internet message boards adopted the new term when speaking about "owning" someone. Hackers also use pwn as a slang term when breaching a network or device.
And thus, have I been pwned? was born!
<h3>Who is behind haveibeenpwned.com?</h3>
After a spate of high-profile data breaches, Australian security expert Troy Hunt founded &ldquo;have I been pwned?&rdquo; in December 2013. Troy says the Adobe breach of 2013 affecting 153 million accounts was the catalyst to start the service.
When Troy started in 2013, he indexed just five data breaches: Adobe Systems, Stratfor, Gawker, Yahoo! Voices, and Sony Pictures.
Today, have I been pwned? has 556 compromised websites affecting more than 11 billion accounts!
Troy and his team have created tools and systems to update the website as soon as they're made public. have I been pwned? also lists its recently added breaches and the largest data breaches&mdash;the current number one being <a href="https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/">Collection #1's 2019 breach affecting 773 million unique email accounts</a>!
Troy also has a blog where he releases details about data breaches and discusses cybersecurity matters.
&rlm;&rlm;&lrm; &lrm;
<h2>How does the site "have I been pwned" Work?</h2>
Users have a few search options on have I been pwned?. On the home page, you can enter your email or mobile number to do a personalized search.&nbsp;
Users can also perform a domain search, a helpful feature for companies to determine if they've been pwned.
You can also sign up to the have I been pwned? mailing list for instant updates to the latest breaches and notification if your email is ever compromised.
<h3>Collecting and Categorizing Data</h3>
Data breaches contain thousands or millions of records (billions of records in the most extreme cases!). Some records have personal information, while others are more mundane. It's not as simple as importing those records into a spreadsheet and searching for a specific user.
Records are not always easy to read. They often reference a user's account number or other non-personal identifiers. For example, if you see a record containing credit card details and a personal identifier, you have to search the database using that identifier to find the actual user.
Even if you find the user, you might need to search several folders to see all of their personal information.
Most people don't have the time or resources to sift through gigabytes of data, trying to find out if they're victims of a breach.
"It's a bit of an unfair game at the moment &ndash; attackers and others wishing to use data breaches for malicious purposes can very quickly obtain and analyse the data, but your average consumer has no feasible way of pulling gigabytes of gzipped accounts from a torrent and discovering whether they've been compromised or not." - Troy Hunt, have I been pwned? Founder,
have I been pwned? organizes all of that personal data into searchable databases so users can find their stolen data fast!
&rlm;&rlm;&lrm; &lrm;
<h2>What to do if You Have Been Pwned</h2>
So, what do you do if you find out you're a data breach victim?
The first thing you must do is change all of your passwords linked to that email address. You should be <a href="https://teampassword.com/blog/how-often-should-you-change-your-password-the-importance-of-password-safety">changing your passwords</a> monthly for personal accounts, while businesses might want to consider changing passwords weekly.
Changing your passwords monthly or weekly can be challenging without a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a>. With TeamPassword, you can change account credentials and update them for all users with one click.
If the account has sensitive data, you might want to consider changing the email address too. That way, if you receive any correspondence to the compromised email, you can mark it as spam and delete it.
Lastly, be hyper-vigilant when it comes to emails containing links and attachments&mdash;not only if you're a victim of a data breach. Get into the habit of checking the sender's email address properly, even if it appears to come from a familiar source.
For example, if you get an email that someone has sent you a message in Slack, delete the email and open Slack separately. Do this for all accounts where you receive notifications: WordPress, flight bookings, social media, marketing/productivity tools, and other web/app accounts.
Attackers often send fake correspondence from seemingly legitimate sources to get you to click a link or open an attachment. Doing so will install malware, giving criminals remote access to your device where they can steal personal information and passwords!
&rlm;&rlm;&lrm; &lrm;
<h2>Protecting Your Passwords</h2>
Passwords are the keys to our digital assets and accounts. Just like you protect your home or office with locks and alarms, so too must you secure your online presence.
For individuals, securing credentials is relatively simple but still requires you to be "street smart."
But, for a company sharing credentials with multiple teams, clients, freelancers, and contractors, <a href="https://app.teampassword.com/dashboard#signup/testimonial">password management</a> is significantly more challenging.
Companies that don't use a password manager to <a href="https://teampassword.com/blog/how-to-safely-share-passwords-with-coworkers">share credentials safely with coworkers</a> are vulnerable to attack, particularly if team members use emails and spreadsheets for sharing.
Many companies also use weak passwords or the same passwords for multiple accounts, making it easy for attackers to guess the credentials! With so many <a href="https://teampassword.com/password-generator">free secure password generators</a> available, this practice is simply inexcusable.
&rlm;&rlm;&lrm; &lrm;
<h2>The TeamPassword Solution for Small Businesses</h2>
Large organizations with massive cybersecurity budgets have access to sophisticated tools and systems to prevent breaches&mdash;and still fall victim to attacks!
For small businesses, most of these cybersecurity tools are simply too expensive!
<a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> is an affordable password management solution with robust security features and state-of-the-art encryption technology.
<h3>Safe &amp; Easy Password Sharing</h3>
Instead of sharing raw login credentials, you provide access to team members through TeamPassword. Employees then use one of TeamPassword's browser extensions (Chrome, Firefox, and Safari) to log into accounts.
Create groups for your various accounts and provide access through TeamPassword only to those who need it. When someone no longer requires access, remove them with a single click.
<h3>Say Goodbye to Weak Passwords</h3>
With TeamPassword's built-in password generator, you never have to worry about weak passwords or reusing the same credentials for multiple accounts.
Instantly create robust passwords from 12-32 characters with lowercase, uppercase, symbols, and numbers. TeamPassword references your saved passwords to ensure you never reuse the same credentials.
If you need to change a password, you can generate a new password and update the new credentials for all users&mdash;while they continue to work without disruption or asking why they can't log in!
<h3>Prevent a TeamPassword Breach with Two-factor Authentication</h3>
Coworkers can secure their <a href="https://teampassword.com/blog/password-manager-with-2fa">TeamPassword account with two-factor authentication (2FA)</a>. If an attacker manages to steal an employee's TeamPassword credentials, 2FA prevents criminals from accessing the account.
TeamPassword uses Google Authenticator for 2FA, available on all mobile devices, including iOS and Android.
<h3>Activity Logging &amp; Notifications</h3>
Monitor your company's digital assets using TeamPassword's activity log. The activity log lets you see who has logged in and when, new members added to a group, password updates, and more.
You can also set up email notifications for instant alerts to all of TeamPassword's actions. Perfect for monitoring sensitive data and accounts.
&rlm;&rlm;&lrm; &lrm;
<h2>Sign up for Free Today</h2>
Don't let hackers pwn you or your company!&nbsp;
Stay ahead of data breaches and secure your company's digital assets with <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a>. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> and start sharing passwords securely with TeamPassword today!

Have i been pwned? is an invaluable tool to see whether your passwords have been compromised. Learn what to do if you are a victim of a leak

Have i been pwned? is an invaluable tool to see whether your passwords have been compromised. Learn what ...

Have i been pwned? What to do When it Happens

Have I been pwned? What to do if it happens to you.

The First American Corporation data leak is a wake-up call for regulators to clamp down hard on organizations that fail to protect their customers.&nbsp;
<a href="https://teampassword.com/blog/category/data-breaches">Data breaches</a> are one thing, but leaving customer data unprotected online is highly negligent and questions an organization's competence!
Any time criminals steal data from organizations like First American Corporation, it's the customers (including businesses) who suffer most!
&rlm;&rlm;&lrm; &lrm;
Don't let your business suffer the fallout from a data breach. Use <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> to protect your company's digital assets. <a href="about:blank">Sign up for a free trial</a> today!
&rlm;&rlm;&lrm; &lrm;
<h2>What is First American Corporation?</h2>
Founded in Orange County, California, in 1889, First American Corporation is a financial services company in the real estate industry.
The Fortune 500 company is valued at over $7.5 billion (in 2021) and employs just under 20,000 people.
First American Corporation has several subsidiaries, including a subsidiary in India, employing more than 4,000 employees.
&rlm;&rlm;&lrm; &lrm;
<h2>What Happened at the First American Corporation Data Leak in 2019?</h2>
The First American Corporation Data Leak is a shocking example of corporate negligence. Luckily, it appears First American Corporation's customers managed to avoid having their data end up in the hands of criminals.
In May 2019, Ben Shoval, a Washington state real estate developer, stumbled upon approximately 885 million files containing customer data dating back to 2003!
You had to have a specific URL to find the files on firstam.com. But, once you had one URL, all you had to do was increment or decrement the URL to access other records.
Many of First American Corporation's exposed records were wire transactions between property buyers and sellers with account numbers and other financial information.
<h3>Leaked, Not Stolen!</h3>
It's important to note that although the First American Corporation data was freely available, it doesn't appear that anyone stole any of the company's records.
Unlike a data breach where criminals hack into a network, human error usually causes a data leak.
In First American Corporation's case, a website configuration error called Insecure Direct Object Reference (IDOR) allowed customers to view private information without any authentication.
First, American Corporation's records are sequential, so Mr. Shoval could change the number in the URL to access other customer records.
It's unclear how long First American Corporation's data was available online, but a search on archive.org revealed the company's records were available to around March 2017!
<h3>What Kind of Data Was Leaked?</h3>
Most of the files appeared to be scans of original documents, including property buyer and seller forms, IDs, SSNs, driver's licenses, account statements, internal corporate information for small businesses, physical addresses, contact numbers, email addresses, and other sensitive information and documentation.
Essentially a treasure trove for criminals to carry out identity theft, spear-phishing attacks, and other social engineering attacks.
<h3>Early Warnings Ignored!</h3>
Penetration tests flagged First American Corporation's exposed records in 2018, but the problem remained unfixed due to a comedy of errors and administrative blunders.
&rlm;&rlm;&lrm; &lrm;
<h2>What was the Fallout of the First American Corporation Data Leak?</h2>
You'll be sad to learn that the $7.5+ billion First American Corporation got a mere slap on the wrists for its negligence.&nbsp;
The New York State Department of Financial Services found First American Corporation had breached new cybersecurity protections implemented in 2017.
First American Corporation was the first company to receive enforcement action under the new cybersecurity law, reluctantly agreeing to a fine of $487,616 with The New York State Department of Financial Services.
&rlm;&rlm;&lrm; &lrm;
<h2>Is Your Company Prepared for a Data Leak?</h2>
Data leaks like the First American Corporation in 2019 or <a href="https://teampassword.com/blog/what-happened-with-the-cam4-data-leak">CAM4 in 2020</a> put customers at severe risk of cyberattacks.
This sort of personal information gives criminals the means to impersonate companies and individuals or even target them through various social engineering attacks.
<h3>Spear-Phishing Attacks</h3>
One of the most significant risks from a leak like this is that criminals have enough personal information to carry out a successful spear-phishing attack.&nbsp;
Using data from First American Corporation, criminals could pose as the organization sending spear-phishing emails replicating the bank's correspondence.
The email might include personal information that only the bank would know, increasing the likelihood of a victim clicking a link or opening an attachment&mdash;most likely containing malicious packages giving criminals access to the victim's device and network!
Once attackers breach a user's device, they steal data and passwords to access other accounts, devices, and networks.
Protecting your company's passwords is crucial to preventing a full breach of your systems and accounts!
&rlm;&rlm;&lrm; &lrm;
<h2>Protecting Passwords with TeamPassword</h2>
TeamPassword is a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a> designed for small businesses to share credentials safely amongst team members.
You never have to share raw login credentials. Instead, all of your <a href="https://teampassword.com/blog/how-to-safely-share-passwords-with-coworkers">passwords are safely stored and shared with TeamPassword</a>. Employees use one of TeamPassword's browser extensions to log in&mdash;exactly as you would with a <a href="https://teampassword.com/blog/should-i-use-my-browsers-built-in-password-manager">password saved in a browser</a>.
With two-factor authentication 2FA, even if attackers steal a team member's password through a phishing attack, they won't have access to <a href="https://app.teampassword.com/dashboard#signup/testimonial">your TeamPassword account</a>.
<h3>Creating, Storing, &amp; Saving Passwords</h3>
TeamPassword features a built-in password generator, so you never have to worry about <a href="https://teampassword.com/blog/10-things-you-need-to-do-to-keep-passwords-safe">weak passwords or reusing credentials</a>. You can create passwords from 12-32 characters using uppercase, lowercase, numbers, and symbols.
Once a new password is created, TeamPassword automatically updates the new credentials for all users so team members can continue working without interruption.
<h3>Groups &amp; Sharing</h3>
You can create groups for your various accounts and only provide access to those who need it.&nbsp;
If you work with freelancers or contractors, you can add them to a group for the duration of their employment and remove them when the job is done&mdash;no need to change credentials when a team member leaves!
<h3>Keep Track of TeamPassword Activity</h3>
TeamPassword's activity log provides you with dates and times of login history. You can also set up email notifications for every <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> action, allowing you to stay on top of your most sensitive data and accounts.
<h3>Accredited Secure Hosting Provider</h3>
<a href="https://teampassword.com/security">TeamPassword uses state-of-the-art encryption technology</a> and holds several internationally recognized security accreditations.\
Our team regularly conducts vulnerability sweeps to ensure our systems are watertight against breaches and attacks.
&rlm;&rlm;&lrm; &lrm;
<h2>Get TeamPassword for Free!</h2>
Don't let your business become another data-breach statistic! Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial">14-day free trial</a> and secure your company's digital assets with <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> today!

The First American Corporation data leak in 2019 left thousands of customer's data unprotected. What happened, and what was the fallout?

The First American Corporation data leak in 2019 left thousands of customer's data unprotected. What happened, and what ...

The First American Corporation Data Leak what happened?

Mustang Panda is a Chinese cyberespionage group that primarily targets non-governmental organizations (NGOs) and US think tanks. It's unclear whether Mustang Panda operates independently or works for the Chinese government.
The group is somewhat creative in its ability to use legitimate software and tools to mask the deployment of malware and trojans.
Keep your passwords safe from bad actors like Mustang Panda. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword trial</a> and prevent attackers from breaching your digital assets.
&rlm;&rlm;&lrm; &lrm;
Try our <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">14-day free trial</a> and start protecting yourself today with TeamPassword
&rlm;&rlm;&lrm; &lrm;
<h2>Who is Mustang Panda?</h2>
Mustang Panda was first discovered in 2017 by CrowdStrike, but there are indications that the group has been active since as early as 2014.
Mustang Panda attacks government entities and NGOs, especially those critical of China. The group has a preference for NGOs working on social, humanitarian, and environmental policies.
These NGOs often challenge government policies, so it makes sense that state entities (not just China) would attempt to spy on these organizations. They may want to find out protected sources, sensitive research information, steal intellectual property or even discredit the NGO's work.
Most of Mustang Panda's operations are in Southern and Southeast Asia but are particularly active in Mongolia. The group has also attacked NGOs, religious institutions, and think tanks in the United States, the United Kingdom, Australia, and Europe.
<h3>Mustang Panda Aliases</h3>
Here is a list of Mustang Panda aliases assigned by intelligence agencies and security firms:
<ul>
<li style="font-weight: 400;" aria-level="1">Bronze President</li>
<li style="font-weight: 400;" aria-level="1">TEMP.Hex</li>
<li style="font-weight: 400;" aria-level="1">HoneyMyte</li>
<li style="font-weight: 400;" aria-level="1">LuminousMoth</li>
<li style="font-weight: 400;" aria-level="1">Red Lich</li>
<li style="font-weight: 400;" aria-level="1">TA416</li>
<li style="font-weight: 400;" aria-level="1">RedDelta (Some security analysts are unsure if RedDelta is, in fact, Mustang Panda. But there are a lot of similarities. Only a few toolsets and minor tactics differ.)</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2>What does Mustang Panda do?</h2>
Mustang Panda's primary objective appears to be gathering intelligence on NGOs, nonprofits, religious organizations, and think tanks. It's likely to provide China with intel to get ahead of bad press or attempt to influence policy in other countries.
Mustang Panda is excellent at exploiting software vulnerabilities and using familiar tools, like Google Drive and link shorteners, so users are less likely to be suspicious.
The group often sends PDFs to its victims that require an "Adobe Flash Update." Clicking the UPDATE button drops Mustang Panda's malware and trojans, providing access to the victim's device and network.
More recently, Mustang Panda has exploited COVID-19 by creating a fully functioning infection-tracking app for Android devices. The app contains SpyNote Remote Access Trojan (RAT), allowing Mustang Panda to monitor a user's activity, control the camera and microphone, access and copy all the phone's data, intercept incoming calls and texts&mdash;essentially use the device as the user does!
In addition to apps, Mustang Panda also used a spear-phishing campaign to send a malicious PDF with "COVID-19 information."
&rlm;&rlm;&lrm; &lrm;
<h2>Famous Mustang Panda Attacks</h2>
Mustang Panda is somewhat new compared to other Chinese advanced persistent threat groups like Goblin Panda, Emissary Panda, and Gothic Panda&mdash;to name a few!
<h3>The Vatican &amp; Catholic Churches - 2020</h3>
With negotiations set to take place between The Vatican and the Chinese Communist Party (CCP) in September 2020, Mustang Panda (operating as RedDelta) successfully infiltrated several Catholic organizations in March 2020, including the Vatican.
The CCP was looking for more control and insight over the Catholic church in China. So hacking these institutions would provide them with intel and possibly leverage over the negotiations.
RedDelta gained access through a spear-phishing attack&mdash;an email from the Vatican to Msgr. Javier Corona Herrera, a chaplain at the Hong Kong Study Mission to China.
The attachment contained a message of sadness about the recent death of a bishop. Also included was malware giving RedDelta to the Hong Kong Study Mission to China's offices and the Vatican's mail servers.
From there, RedDelta moved laterally through the Vatican's systems using intelligence to send highly relevant spear-phishing campaigns.
<h3>LuminousMoth Campaign - 2020</h3>
In 2020, Mustang Panda (operating as LuminousMoth) successfully hacked around 1,500 victims in Myanmar and the Philippines.&nbsp;
First, LuminousMoth targeted victims through a spear-phishing campaign that downloaded malware and trojans to the victim's device&mdash;at the same time, copying these files to any removable USB drives.
LuminousMoth would have access to any other devices using the same USB drive.&nbsp;
Security analysts were a little confused by the LuminousMoth campaign as it didn't appear to have any real target or goal. Unusual for cyberespionage groups.&nbsp;
The LuminousMoth campaign was likely a way for Mustang Panda to test new tools and tactics.
&rlm;&rlm;&lrm; &lrm;
<h2>Is Your Company Prepared for Cyber Attacks?</h2>
It feels like we hear about fresh cyberattacks and methods every day! Cyber attacks are no longer something large organizations and government institutions need to worry about.
Effective <a href="https://teampassword.com/blog/cybersecurity-for-small-businesses">cybersecurity for small businesses</a> is crucial to protect your company, clients, and team members from attacks.&nbsp;
These are our top 5 tips for <a href="https://teampassword.com/blog/5-tips-to-increase-security-for-your-remote-workforce">increasing cybersecurity at your company</a>.
<h3>1 - Use a Password Manager - TeamPassword</h3>
A <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a> is an essential tool for companies to share passwords safely with team members, contractors, and freelancers.
We designed <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> with small businesses and agencies in mind. With TeamPassword, you never expose raw login credentials&mdash;mitigating the risk of unauthorized sharing and access.
Create groups in TeamPassword for different teams, client accounts, or projects, so you only provide access to those who need it!
The robust password manager also features a built-in <a href="https://teampassword.com/password-generator">password generator</a>, <a href="https://teampassword.com/blog/password-manager-with-2fa">two-factor authentication (2FA)</a>, activity logging, email notifications, and other essential security features.
<h3>2 - Educate Employees</h3>
Educating your team is key to preventing cyber attacks. This education isn't a one-off event&mdash;security risks change and evolve all the time.&nbsp;
Creating a dedicated security Slack channel or company cybersecurity wiki is one way your team can stay on top of attack trends and vulnerabilities.
<h3>3 - Always Install Updates</h3>
Software and firmware updates fix bugs and other security vulnerabilities. These bugs provide attackers with creative methods to breach apps and systems&mdash;so updating is crucial.
Make sure you and your team always install updates as soon as they're available.
<h3>4 - Keep Personal &amp; Work Devices Separate</h3>
Always mandate that employees use a separate device for work&mdash;preferably a company-issued computer or laptop set up by your company's IT team.
Employees must not use these devices for personal email or surf the web. By separating work and personal devices, you eliminate the risk of being a casualty if your employee falls victim to a personal cyber attack.
<h3>5 - Implement Two-Factor Authentication (2FA)</h3>
2FA is an affordable and highly effective way to prevent attackers from breaching your accounts, even if they steal a team member's password.
For example, <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> uses 2FA for logging in. Employees have to enter their password, plus a random six-digit code from Google Authenticator to access their account.
Without the employee's device (iOS or Android), attackers can't log into TeamPassword, even if they've stolen their password.
&rlm;&rlm;&lrm; &lrm;
<h2>Try TeamPassword for Free!</h2>
Cybersecurity starts with protecting your account passwords. Prevent attackers from stealing your company's passwords with <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a>. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a free trial today</a>!

Mustang Panda is a cyberespionage group that targets non-governmental organizations, but how can you protect your company from this group?

Mustang Panda is a cyberespionage group that targets non-governmental organizations, but how can you protect your company from ...

Who is Mustang Panda and how can you protect yourself?

Goblin Panda is one of a handful of elite Chinese advanced persistent threat (APT) groups. Most Chinese APTs target the United States and NATO, but Goblin Panda focuses primarily on Southeast Asia.
The group is highly active, carrying out regular attacks since CrowdStrike first observed them in 2013.
&rlm;&rlm;&lrm; &lrm;
Using a password manager can help your business prevent <a href="https://teampassword.com/blog/category/data-breaches">data breaches</a>. Secure your company's digital assets and sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial">free TeamPassword trial</a> today!
&rlm;&rlm;&lrm; &lrm;
<h2>Who is Goblin Panda?</h2>
Goblin Panda is one of China's most active cyberespionage groups&mdash;some speculate one of the most active APT groups in the world! The group carries out regular attacks in Southeast Asia and Japan but is most active in Vietnam.
Intelligence agencies and security firms have been unable to distinguish whether Goblin Panda works directly for the Chinese government or acts as a contractor.&nbsp;
<h3>Goblin Panda Aliases</h3>
Goblin Panda goes by several aliases, including:
<ul>
<li style="font-weight: 400;" aria-level="1">Hellsing</li>
<li style="font-weight: 400;" aria-level="1">Conimes</li>
<li style="font-weight: 400;" aria-level="1">Cycldek</li>
<li style="font-weight: 400;" aria-level="1">1937CN</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2>What does Goblin Panda do?</h2>
Goblin Panda is famous for delivering exploits in Microsoft Office Word attachments which drop malware and trojans onto the victim's device upon opening.
The group targets its victims through researched spear-phishing email campaigns, sending personalized emails with document attachments.
These documents are usually specific to the region and user. For example, in Vietnam, Goblin Panda regularly creates fake "official" Vietnamese government documents written in Vietnamese.
The group's focus on Southeast Asia, South Korea, and Japan are to gather intelligence on China's neighbors in disputes over the contested waters and islands of the South China Sea.
Goblin Panda is also responsible for attacks in Europe, the United States, Australia, the Middle East, and Africa.
&rlm;&rlm;&lrm; &lrm;
<h2>Famous Goblin Panda Attacks</h2>
Goblin Panda's primary targets are in defense, energy, and government entities. The group usually uses PlugX and HttpTunnel malware to create "backdoors"&mdash;tools and tactics that Chinese hacker groups commonly use.
<h3>The Philippines and Vietnamese Website Attacks - 2015</h3>
Goblin Panda (operating under 1937CN) went on a hacking spree in 2015, attacking around 1,000 websites in Vietnam and 200 in the Philippines.&nbsp;
The Vietnamese websites included 15 state-run websites and 50 education sites.
Attacks like these on Southeast Asian nations are common and often linked to Goblin Panda/1937CN.
<h3>Attacks on Multiple Vietnamese Airports - 2016</h3>
In 2016, Goblin Panda (operating under 1937CN) attacked 21 Vietnamese airports, including Hanoi's Noi Bai International Airport and Ho Chi Minh City's Tan Son Nhat International Airport.
The group took over public address systems, including loudspeakers and information screens, to communicate offensive language and Chinese propaganda about the South China Sea.
The airports had to disconnect the internet temporarily and complete check-ins, boarding, announcements, and flight information manually.&nbsp;
At the same time, 1937CN hacked and "defaced" Vietnam Airlines' website and managed to steal personal data for 411,000 passengers.&nbsp;
The motive for the 2016 attack was to send Vietnam and the Philippines a warning message&mdash;likely in connection with South China Sea's disputed waters.
This attack is exceptionally brazen and unusual for an advanced persistent threat. Most groups prefer covert operations and avoid revealing anything that could tie them back to their respective government.
Goblin Panda's messages through Vietnam's airports are very public threats to Southeast Asian nations from the Chinese government.
&rlm;&rlm;&lrm; &lrm;
<h2>First Steps to Prevent Cyber Attacks</h2>
Cyberattacks have increased significantly since the start of the pandemic. As lockdowns continue and people get desperate, we'll likely see even more breaches and ransomware attacks.
You must have robust systems in place to prevent breaches and cyber attacks. Your team members are the first line of defense, so <a href="https://teampassword.com/blog/your-passwords-are-only-as-secure-as-your-teams">educating employees about cybersecurity</a> must be a priority!
As sophisticated as a group like Goblin Panda might be, they still need to steal a user's password to access systems and networks.
Nearly all breaches happen because attackers manage to steal a team member's credentials. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Securing your company's passwords</a> is another crucial step to preventing breaches and unauthorized credential sharing.
&rlm;&rlm;&lrm; &lrm;
<h2>Secure Password Management with TeamPassword</h2>
<a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> makes it safe and easy for small businesses to manage passwords. Sharing passwords via email, Slack, spreadsheets, and other unsecure methods, increases your risk of attack significantly!
With TeamPassword, you never share login credentials. Instead, each team member gets a TeamPassword account and then uses a browser extension (Chrome, Firefox, and Safari) to access applications, websites, and other accounts.
<h3>Groups and Sharing</h3>
TeamPassword lets you create unlimited groups for sharing access to accounts. For example, your social media group in TeamPassword would access your social media accounts and scheduling software.&nbsp;
If you need to hire a freelancer or contractor, simply add them to a group and remove them when they're done&mdash;no need to worry about changing passwords just because someone has left the team or company.
You can also use the same TeamPassword account for all of your client's digital assets. Keeping all your credentials in one place eliminates the risk of team members distributing passwords across spreadsheets, email, and Slack threads.
<h3>Activity Log &amp; Email Notifications</h3>
Stay on top of team member activity and prevent unauthorized access and sharing with TeamPassword's activity log and email notifications.
TeamPassword lets you create instant email notifications for every action (logins, credential sharing, new accounts, and more)&mdash;allowing you to keep track of your most sensitive data.
<h3>Secure Unique Password Generator</h3>
Using the same password for multiple accounts makes it easy for hackers to take over your entire digital portfolio, FAST. Weak passwords are another common mistake small businesses make.
With TeamPassword's built-in <a href="https://teampassword.com/password-generator">secure unique password generator</a>, you never have to worry about weak passwords or using the same credentials more than once.&nbsp;
The password generator lets you create secure passwords from 12-32 characters with uppercase, lowercase, numbers, and symbols.
<h3>Two-Factor Authentication (2FA)</h3>
Two-factor authentication (2FA) is crucial for keeping your <a href="https://teampassword.com/blog/password-manager-with-2fa">TeamPassword account safe from hackers</a>. TeamPassword uses Google Authenticator, available on all iOS and Android devices.
Even if attackers manage to steal an employee's TeamPassword credentials, 2FA will prevent them from accessing their account.
&rlm;&rlm;&lrm; &lrm;
<h2>Get a Free TeamPassword Account</h2>
Test our robust <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a> with your team to see how easy and secure credential sharing can be with TeamPassword. Sign up for TeamPassword and get a <a href="https://app.teampassword.com/dashboard#signup/testimonial">free 14-day trial</a> today!

Goblin Panda is one of the elite Chinese advanced persistent threat groups. So how can you protect your company from them? | TeamPassword

Goblin Panda is one of the elite Chinese advanced persistent threat groups. So how can you protect your ...

Who is Goblin Panda and how can you protect yourself?

Gothic Panda is a known Chinese state-sponsored cyberespionage group. The highly skilled attackers regularly use zero-day exploits to breach networks&mdash;a sophisticated hacking technique that takes weeks or months to execute.
The group has been operating since the mid-2000s attacking various state contractors in the United States and US government entities.
We saw a <a href="https://teampassword.com/blog/the-biggest-data-breaches-of-2020">significant increase in cyber-attacks in 2020</a>. Is your business protected?
&rlm;&rlm;&lrm; &lrm;
Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial">free 14-day TeamPassword trial</a> and protect your company's digital assets from attacks!
&rlm;&rlm;&lrm; &lrm;
<h2>Who is Gothic Panda?</h2>
Gothic Panda is an advanced persistent threat group known to US Intelligence as APT3. Investigations revealed that Gothic Panda has direct links to the Chinese Ministry of State Security (MSS) and other Chinese agencies.
Until 2015, Gothic Panda's primary target was the United States. But, since March 2016, the group's focus shifted to Hong Kong, where they attacked political entities and critics of the Chinese Communist Party.
<h3>Gothic Panda Aliases</h3>
Gothic Panda goes by many aliases assigned by intelligence agencies and security firms.
<ul>
<li style="font-weight: 400;" aria-level="1">APT3 (Advanced Persistent Threat 3 - US federal government classification)</li>
<li style="font-weight: 400;" aria-level="1">Buckeye</li>
<li style="font-weight: 400;" aria-level="1">TG-0110</li>
<li style="font-weight: 400;" aria-level="1">Bronze Mayfair</li>
<li style="font-weight: 400;" aria-level="1">UPS Team</li>
<li style="font-weight: 400;" aria-level="1">Group 6</li>
<li style="font-weight: 400;" aria-level="1">Pirpi</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2>What does Gothic Panda do?</h2>
Gothic Panda hacks tech, transportation, telecommunications, aerospace, and defense companies to steal intellectual property.&nbsp;
In addition, the group attacks India, Vietnam, Hong Kong, the US, and NATO-aligned state entities to gather intelligence and steal state secrets.
Gothic Panda has an extensive range of tools and techniques to breach systems and networks. The group is especially good at zero-day exploits and spear-phishing attacks.
Once inside a system, Gothic Panda uses highly sophisticated tools to provide remote access, create multiple "backdoors," and remain undetected for months.
&rlm;&rlm;&lrm; &lrm;
<h2>Famous Gothic Panda Attacks</h2>
Due to the sensitive data and the high-level state entities Gothic Panda targets, we know little about many of the group's attacks.
<h3>Operation Clandestine Fox - 2014</h3>
Operation Clandestine Fox is one of Gothic Panda's first significant zero-day attacks. The group discovered an unknown vulnerability in Microsoft's Internet Explorer (IE), allowing them to get around the browser's security features.
By circumventing IE's security, Gothic Panda could infect a user's device through watering-hole attacks. The security vulnerability affected an Adobe Flash plugin for IE6 to IE11, but Gothic Panda targeted IE9 and IE10 users.
Disabling Adobe Flash meant you could use IE without worrying about the attack, but most people discontinued using Microsoft's browser until they fixed the problem&mdash;some never returned to IE!
Luckily, FireEye Research Labs found the zero-day exploit early. Still, it took several days for Microsoft to fix the vulnerability, and only a few users fell victim to Operation Clandestine Fox.
In a statement, Microsoft stated: "The reality is there have been a very small number of attacks based on this particular vulnerability and concerns were, frankly, overblown."
<h3>Operation Clandestine Fox - Part 2 - 2014</h3>
Shortly after Microsoft fixed IE, Gothic Panda switched tactics to contacting US companies through a spear-phishing campaign.&nbsp;
The perpetrators would first "friend" or "follow" a victim's friends and family on social media. Next, they would send direct messages (DMs) and emails pitching themselves as potential tech candidates looking for work.
The correspondence contained malicious links and attachments designed to provide Gothic Panda access to the user's device.
The tools and tactics were identical to Operation Clandestine Fox, leading investigators to believe the group had quickly changed its method of attack after the Microsoft patch on IE.
<h3>DoublePulsar Backdoor - 2016</h3>
In 2017, hacker group The Shadow Brokers leaked tools and zero-day exploits from "Equation Group," a suspected branch of the National Security Agency (NSA).
While there was no evidence to tie Gothic Panda to The Shadow Brokers leak in 2017, the group used variants of Equation Group's leaked tools in 2016 for cyberattacks in Belgium, Luxembourg, Hong Kong, Vietnam, and the Philippines.
Investigators believe that either Gothic Panda had stolen these tools earlier or The Shadow Brokers weren't the source of the 2017 leak.
<h3>C919 airplane - 2010 to 2015</h3>
A 2019 report from security firm CrowdStrike shows how the Chinese Ministry of State Security used multiple hacker groups, including Gothic Panda, to breach aviation and aerospace companies worldwide.
When hackers could not breach a target, the MSS recruited Chinese nationals working at these companies to install malware on the victim's network.
The MSS wanted to steal intellectual property to help a Chinese state-owned aerospace manufacturer build its C919 airplane.&nbsp;
The operation was a success for China, but experts pointed out more than 20 parts and equipment on the C919 stolen from primarily European and American companies.
The United States indicted several Chinese nationals, but China hasn't responded to requests for extradition.
&rlm;&rlm;&lrm; &lrm;
<h2>Protect Your Business from Cyber Attacks</h2>
Cyber attacks are increasing at an alarming rate. We saw many <a href="https://teampassword.com/blog/the-biggest-data-breaches-of-2020">significant data breaches in 2020</a>, including the infamous SolarWinds attack and the <a href="https://teampassword.com/blog/what-happened-with-the-cam4-data-leak">CAM4 data leak</a>.
More recently, we've seen how attackers <a href="https://teampassword.com/blog/t-mobile-data-breach-2021-what-happened">breached T-Mobile</a>, affecting around 40 million users!
Preventing attacks starts with <a href="https://teampassword.com/blog/your-passwords-are-only-as-secure-as-your-teams">educating employees about cybersecurity risks</a>. Most attacks happen due to human error, so a well-educated, vigilant team will thwart most attacks.
Secondly, make sure you update software, firmware, and applications as soon as an update is released. These updates often fix zero-day exploits and other vulnerabilities groups like Gothic Panda use for attacks.
The next step is to protect your passwords. Using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager like TeamPassword</a> allows you to <a href="https://teampassword.com/blog/how-to-safely-share-passwords-with-coworkers">share access safely</a> without exposing passwords.
Instead of entering credentials, team members use one of TeamPassword's browser extensions (Chrome, Firefox, and Safari) to log in to social media, productivity tools, web apps, and other accounts your company uses.
You can create groups for sharing credentials and remove a team member when they no longer need access. This feature is fantastic for businesses that regularly <a href="https://teampassword.com/blog/keeping-data-secure-when-working-with-freelancers">share passwords with freelancers and contractors</a>.
Instead of sharing multiple passwords, you share one key to unlock them all. <a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> has an activity log and email notifications so you can monitor user behavior and prevent unauthorized access.
Other TeamPassword security features include:
<ul>
<li style="font-weight: 400;" aria-level="1">Two-factor authentication (2FA)</li>
<li style="font-weight: 400;" aria-level="1">Built-in secure password generator</li>
<li style="font-weight: 400;" aria-level="1">Advanced encryption technology</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
TeamPassword offers a <a href="https://app.teampassword.com/dashboard#signup/testimonial">free 14-day trial</a> for businesses to test the password manager's features with team members.

Gothic Panda is a known Chinese state-sponsored cyberespionage group, so what can you do to protect yourself from Gothic Panda?

Gothic Panda is a known Chinese state-sponsored cyberespionage group, so what can you do to protect yourself from ...

Who is Gothic Panda and how can you protect yourself?

In an increasingly digital world, we&rsquo;re switching more and more of our daily lives over to the Internet. While this brave new world is exciting and convenient, it&rsquo;s not without its problems.&nbsp;
The issue of unsafe passwords has been around for a while. But have you ever thought about where and how to store them?
Most of us have several passwords, and we&rsquo;re encouraged to never duplicate them. Some people simply write them all down on a piece of paper &mdash; which is fraught with danger. But others store their passwords electronically.
As you&rsquo;re about to find out, not all electronic systems of password storage are <a href="https://www.teampassword.com/blog/10-things-you-need-to-do-to-keep-passwords-safe" target="_blank" rel="noopener">safe</a>. Here are five of the most dangerous ways to store your passwords.&nbsp;
But before we begin:
Avoid bad idea passwords and dangerous storage methods with TeamPassword. This advanced <a href="https://www.teampassword.com/blog/why-you-need-a-password-manager" target="_blank" rel="noopener">password manager</a> features a selection of security features, including password encryption and two-step verification. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">free trial</a> today.&nbsp;

<h2>1. Email</h2>
Have you ever emailed yourself a password to ensure you&rsquo;re never without it? Great idea, right? Actually, emailing yourself your passwords is a really bad idea, and here&rsquo;s why:
<ul>
<li>Emails are usually sent in plain text. Without encryption, your passwords are susceptible if your email account is ever compromised.&nbsp;</li>
<li>Unsafe passwords sent via email often pass through several systems and servers. There&rsquo;ll also be a copy in your sent folder. If someone else can access your email account, your passwords become vulnerable.&nbsp;</li>
<li>Some email platforms store data locally on a drive. If someone steals your computer, phone, or tablet, your passwords become vulnerable.</li>
</ul>
A really bad idea for passwords is to send them via email &mdash; either to yourself or someone else. <a href="https://www.teampassword.com/blog/have-i-been-hacked-how-to-know-for-sure" target="_blank" rel="noopener">Hackers </a>and scammers are more resourceful than ever, and they can often steal your information before you realize you&rsquo;ve been compromised.&nbsp;
It&rsquo;s tempting to send a quick email to yourself containing unsafe passwords when you sign up for new online services. For the sake of an extra minute or two, don&rsquo;t give fraudsters easy access to your accounts. Use an encrypted email vault to safeguard all your passwords.&nbsp;
<h2>2. Online Documents</h2>
A lot of people like the convenience of saving crucial information using online document systems such as Google Docs. But this is a bad idea for passwords, as these systems are designed for text &mdash; not sensitive data.
Yes, a password might protect your online document manager from unauthorized access. But what happens if that password is compromised? Many document software platforms don&rsquo;t offer encryption, two-step verification, or even the most basic security measures.&nbsp;
If you use online documents regularly, you&rsquo;re probably accessing your account on a regular basis &mdash; across several devices. What happens if you step away for a moment to buy a coffee, speak to a friend, or use the bathroom?
A criminal can access an unattended online document platform in seconds. And if this happens, it doesn't take a lot of effort to steal your unsafe passwords.&nbsp;
<h2>3. Instant Messaging Service</h2>
Instant messaging services provide us with a convenient way of staying in touch with friends and family. WhatsApp, Facebook Messenger, and Snapchat were designed for private online conversations &mdash; not for storing passwords.
People who store their passwords on these apps do so because they believe they&rsquo;re fully encrypted. While that&rsquo;s often the case, it&rsquo;s important to remember that instant messaging services are often left open and operating in the background.
Imagine someone picks up your phone while you&rsquo;re not paying attention. If you left your device unlocked, that person would be able to access your password in seconds.
It&rsquo;s always a bad idea when passwords are stored on instant messaging services. By nature, these apps are designed to operate in the background &mdash; alerting you when someone sends a message. And because they&rsquo;re open, anyone with the device in their hand might be able to steal your unprotected passwords.&nbsp;
Don&rsquo;t fall into the trap of utilizing bad ideas for password storage. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">free trial</a> with TeamPassword, and give your unsafe passwords the protection they require.
<h2>4. Online Note-taker</h2>
Developers design online note-takers for everyday lists and reminders. While they&rsquo;re great for creating to-do and shopping lists, they&rsquo;re not so good for storing unsafe passwords.&nbsp;
An app such as Apple Notes is easy to use, accessible, and convenient. But it doesn&rsquo;t offer two-step authentication, encryption, or any sophisticated form of security.&nbsp;
If your computer or mobile device is unlocked, your saved passwords are vulnerable. In many cases, a criminal would simply need to open the app to gain access to your sensitive information.&nbsp;
OK, you might be extra vigilant when it comes to keeping your phone or computer locked. But hackers are resourceful, and they&rsquo;re very good at discovering unsafe passwords. Once they access your phone, any passwords stored in your note-taking app become vulnerable.&nbsp;
<h2>5. On a Non-Password-Protected Device</h2>
Of all the bad ideas for passwords, storing them on non-password-protected devices is about the worst. You might think that your tablet or laptop never leaves your side. But if your device is ever stolen, you&rsquo;ve given the criminals the easiest possible opportunity to access your saved passwords.&nbsp;
If you&rsquo;re determined to store passwords on a physical device &mdash; which is never a good idea &mdash; make sure the device password is a complex combination of letters, numbers, and symbols. And it should contain at least 12 characters.&nbsp;
<h2>Use TeamPassword for Extra Protection</h2>
Remembering and safely storing a dozen or more passwords isn&rsquo;t a simple task. By locking away all your passwords in a digital vault, you get maximum protection and easy access.&nbsp;
TeamPassword offers a range of <a href="https://www.teampassword.com/security" target="_blank" rel="noopener">security features</a> &mdash; designed to keep your passwords safe. Offering two-step authentication and encryption, this powerful protection system solves the problem of unsafe passwords with ease. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">free trial</a> to see these exciting features for yourself.&nbsp;

Storing passwords inappropriately can leave you open to fraud and theft. Avoid these storage methods at all costs. | TeamPassword Blog

Storing passwords inappropriately can leave you open to fraud and theft. Avoid these storage methods at all costs. ...

Top 5 Dangerous Ways to Store Your Passwords

Password encryption is essential to store user credentials stored in a database securely. Without password encryption, anyone accessing a user database on a company's servers (including hackers) could easily view any stored passwords.
Even a strong 32-character password created using a <a href="https://teampassword.com/password-generator">secure password generator</a> is useless without password-encryption! If someone can read your password on a server, they can use it simply by copy/pasting it&mdash;no matter how long or complicated the password might be!
Encryption scrambles your password before saving it on the server. So, if someone hacks the server, instead of finding password123, they find a random series of letters and numbers.
In this article, we're going to explore the world of password encryption, why <a href="https://teampassword.com/blog/tips-and-tricks-to-create-a-strong-password">strong passwords matter</a>, and how you can practice better password management!
<a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> is the password management solution for small businesses! Create, store, and share login credentials safely with employees, contractors, and clients. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> today!
&rlm;&rlm;&lrm; &lrm;[Table of Contents]
<ul>
<li><a href="#understandingpasswordencryption" rel="follow">Understanding Password Encryption</a></li>
<li><a href="#howdoespasswordencryptionwork" rel="follow">How Does Password Encryption Work?</a></li>
<li><a href="#5commonpasswordencryptionmethods" rel="follow">5 Common Password Encryption Methods</a></li>
<li><a href="#whystrongpasswordsmatter" rel="follow">Why Strong Passwords Matter</a></li>
</ul>
<h2 id="understandingpasswordencryption">Understanding Password Encryption</h2>
To explain password encryption effectively, we must first grasp the language. Several terms might be unfamiliar, so here is a quick intro to password encryption terminology.
<ul>
<li style="font-weight: 400;" aria-level="1">Key: Used to lock and unlock passwords using a random string of bits. You get private and public keys that crypt and decrypt data differently, but we won't get too deep in the weeds with keys!</li>
<li style="font-weight: 400;" aria-level="1">Bits: A logical state with one of two possible values, including 1/0, true/false, yes/no, or on/off as typical examples.</li>
<li style="font-weight: 400;" aria-level="1">Block (block cipher): A deterministic algorithm operating on fixed-length groups of bits, called blocks.</li>
<li style="font-weight: 400;" aria-level="1">Hash function: The algorithm that uses the key to create password encryption and decryption. A hash function is essentially a piece of code that runs every time someone saves a password or logs into an application.&nbsp;</li>
<li style="font-weight: 400;" aria-level="1">Hash: A random series of numbers and letters representing your password. The hash function uses your hash instead of the raw password for authentication.</li>
<li style="font-weight: 400;" aria-level="1">Salt: Additional letters and numbers appended to the hash</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2 id="howdoespasswordencryptionwork">How Does Password Encryption Work?</h2>
When you save a new password, a hash function creates a hash version and saves that on the server.&nbsp;
Every time you log in using your password, the hash function recreates the hash to see if it matches what's stored. If the hashes match, the algorithm passes the authentication and logs you in.&nbsp;
For example:
<ul>
<li style="font-weight: 400;" aria-level="1">Original password: Pa$$w0rd123</li>
<li style="font-weight: 400;" aria-level="1">Hashed password: 6AF1CE202340​FE71BDB914AD5357​E33A6982A63B</li>
</ul>
While this might seem secure, simple hashed passwords aren't hack-proof.
The hash function only creates a unique hash for each password, not each user. So, if multiple users have the password, Pa$$w0rd123, the hash will be exactly the same.
To overcome this encryption vulnerability, engineers salt passwords so each hash is unique, even if the passwords are identical.
<h3>How Salt Works</h3>
A salt appends a unique value of 8 bytes (16 characters) to the password before the hash function creates a hash. This way, even identical passwords are unique before the hash function.
For example:
<ul>
<li style="font-weight: 400;" aria-level="1">Two identical passwords: Pa$$w0rd123</li>
<li style="font-weight: 400;" aria-level="1">Salt value one: E1F53135E559C253</li>
<li style="font-weight: 400;" aria-level="1">Salt value two: 84B03D034B409D4E</li>
<li style="font-weight: 400;" aria-level="1">Password one before hash: Pa$$w0rd123E1F53135E559C253</li>
<li style="font-weight: 400;" aria-level="1">Password two before hash: Pa$$w0rd12384B03D034B409D4E</li>
<li style="font-weight: 400;" aria-level="1">Password one hashed value (SHA256): 72AE25495A7981​C40622D49F9A52E4F15​65C90F048F59027BD9​C8C8900D5C3D8</li>
<li style="font-weight: 400;" aria-level="1">Password two hashed value (SHA256): B4B6603ABC670​967E99C7E7F1389E40​CD16E78AD38EB1468E​C2AA1E62B8BED3A</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2 id="5commonpasswordencryptionmethods">5 Common Password Encryption Methods</h2>
<h3>1. Data Encryption Standard (DES)</h3>
While applications no longer use Data Encryption Standard (DES), it's important to mention this password encryption method because of its history and influence on more secure modern standards.
IBM developed DES as a 56-bit encryption technology in the early 1970s. The NSA adopted and improved DES before it was approved worldwide as the encryption standard.
However, since the late 70s, hackers have been able to break DES encrypted passwords. In 1999, ethical hackers managed to break a DES key in under 24 hours.&nbsp;
To make DES more secure, engineers created Triple DES and later Advanced Encryption Standard (AES), which we still use today.
<h3>2. Triple DES</h3>
Triple DES uses three 56-bit keys (blocks) to create 168-bit encryption (some security experts argue that Triple DES is only 112 bits strong). Although Triple-DES is slowly being phased out, many financial institutions still use it to encrypt ATM PINs.
<h3>3. Advanced Encryption Standard (AES)</h3>
AES is the new encryption standard&mdash;trusted by the United States Government and many other prominent organizations globally. At 128 bits, AES is sufficiently secure, but most organizations prefer heavy-duty 256-bit encryption.
At <a href="https://teampassword.com/security">TeamPassword</a>, we use 256-bit encryption to store passwords, ensuring the highest levels of security for our clients. We're also a <a href="https://teampassword.com/security">secure hosting provider</a> holding multiple security accreditations.
Hackers can only break an AES encrypted password through a brute-force attack&mdash;trying password combinations to find the right one.
To counter brute-force attacks, applications will lock an account after a certain number of attempts or use tools like Google's reCAPTURE.
<h3>4. Blowfish</h3>
American cryptographer, Bruce Schneier, designed Blowfish in 1993 as an antidote to the weak DES encryption. Blowfish uses a 64-bit block and variable key length of 32 to 448 bits.
Although Blowfish is more robust than its DES predecessor, the 64-bit block is still vulnerable to attacks, most commonly birthday attacks&mdash;a cryptographic attack that exploits the mathematics behind the algorithm.
To solve Blowfish vulnerabilities, engineers created Twofish in 1998 (128-bit blocks with 256-bit keys) and Threefish in 2008 (256, 516, 1024-bit blocks with 256, 516, 1024-bit keys).
<h3>5. Rivest-Shamir-Adleman (RSA)</h3>
RSA is one of the oldest and widely used to transfer data securely. The encryption works with two keys, two large prime numbers, and an additional auxiliary value.
Due to the complicated encrypting and decrypting process, there is no known method for breaking RSA encryption.&nbsp;
Although widely used for transferring data, RSA is slow and not suitable for password encryption.
&rlm;&rlm;&lrm; &lrm;
<h2 id="whystrongpasswordsmatter">Why Strong Passwords Matter</h2>
Password encryption can only prevent criminals from viewing saved credentials stored on a server&mdash;but cannot prevent hackers from guessing weak/commonly used passwords. If you <a href="https://teampassword.com/blog/colonial-pipeline-ransomware-attack-dont-reuse-passwords">reuse the same password for multiple accounts</a>, this also puts you at risk!
Encryption is most effective when users create robust, unique passwords for every account. For example, a random 32-character password with letters, numbers, and special characters hashed and salted is near impossible to guess or decode, even using a computer!
In another scenario, let's assume you have a strong 32-character password, but you use it for every account. If hackers manage to steal that password, they have access to every account using the same credentials! Your strong password is effectively useless.
<h3>Improving Your Password Management</h3>
Now that you understand password encryption and the associated vulnerabilities, you can see why strong passwords are essential.
Effective password management is crucial to protect yourself against cyberattacks or in the highly likely event of a data breach where hackers steal your credentials.
Criminals are after the low-hanging fruit&mdash;people who use weak passwords!
5 tips for creating stronger passwords:
<ol>
<li style="font-weight: 400;" aria-level="1">Create strong passwords for every account. The easiest way to do this is using a password generator. <a href="https://teampassword.com/password-generator">TeamPassword has a free password generator</a> anyone can use to create passwords from 12-32 characters using uppercase, lowercase, numbers, and special characters. We recommend creating passwords as long as the application will allow.</li>
<li style="font-weight: 400;" aria-level="1">Never create passwords shorter than eight characters, with 12 being our recommended minimum.&nbsp;</li>
<li style="font-weight: 400;" aria-level="1">Never reuse the same password for multiple accounts.</li>
<li style="font-weight: 400;" aria-level="1">Never create passwords with your name, family member's names, or pet's names. With social media, this information is freely available. Criminals can add those names to algorithms for brute-force attacks.</li>
<li style="font-weight: 400;" aria-level="1">Don't store passwords in digital notepads or spreadsheets. We recommend using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager like TeamPassword</a> to create and store your credentials.</li>
</ol>
&rlm;&rlm;&lrm; &lrm;
<h2>Why You Need a Password Manager like TeamPassword</h2>
We have so many accounts these days; it's almost impossible to create unique, memorable, secure passwords for each one. A password manager solves this problem.
Instead of remembering the credentials for every account, you only need to memorize the one to log into your password manager.&nbsp;
TeamPassword keeps all of your credentials safely stored and encrypted, so you never have to memorize a password again. Instead of entering your credentials, you use one of TeamPassword's browser extensions (Chrome, Firefox, and Safari) to log into accounts.
<h3>Built for Teams</h3>
TeamPassword's best feature is its ability to share credentials with team members securely. Instead of sharing passwords, you provide access through TeamPassword.&nbsp;
Employees <a href="https://app.teampassword.com/dashboard#signup/testimonial">use TeamPassword</a> to log in, meaning you never share raw passwords&mdash;no more worrying about unauthorized access or sharing.
You can create groups in TeamPassword to share access with employees, clients, contractors, and freelancers. When someone no longer needs access, remove them from the group with a single click. No need to change passwords every time someone leaves a project!
<h3>Built-In Password Generator</h3>
TeamPassword features a built-in secure password manager so you can create robust passwords for every account. TeamPassword also ensures you never reuse the same credentials so that you won't fall victim to credential stuffing attacks!
With a built-in password generator, you can change passwords regularly, and TeamPassword will update the new credentials for all users!
<h3>Monitor Login Activity</h3>
TeamPassword's activity log keeps track of every action across all of your accounts&mdash;logins, password changes, new team members, sharing access, and more.
You can also set up email notifications for all TeamPassword actions so that you can react fast to any suspicious activity.
<h3>Get Your Free TeamPassword Trial</h3>
Password encryption is not enough to protect your business from password vulnerabilities! You need a robust password manager like TeamPassword to create, store, and share credentials securely.
&rlm;&rlm;&lrm; &lrm;
<a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> and let TeamPassword secure your company's digital assets.

Password encryption is the number one component of password security. TeamPassword encrypts passwords with state-of-the-art technology to keep passwords safe.

Password encryption is the number one component of password security. TeamPassword encrypts passwords with state-of-the-art technology to keep ...

What is password encryption and how much is enough?

What is password encryption and how does it work?

So you think hackers have stolen your password? You're not the only one. 
Perhaps you've noticed strange activity on your email account or frequent pop-ups on your computer. Perhaps it's just a hunch. 
But how can you know&nbsp;for sure?
There are many warning signs that you've been the victim of a data hack:
<ul>
<li>Your device is slower than normal.</li>
<li>You use more data than normal.</li>
<li>Videos take longer to load.</li>
<li>You received an email notification about a password change you didn't make.</li>
<li>An online account no longer accepts your password.</li>
</ul>
However, hackers can steal your passwords and identity&nbsp;without you ever knowing. That's why it's so difficult to tell if you're the victim of a hack.
This guide will help you work out if hackers have stolen your information and tell you how to stop it from happening again.&nbsp;
Prevent hackers from stealing your data by incorporating TeamPassword into your tech stack. This password manager for teams comes with a range of security features like two-step verification and password encryption.&nbsp;<a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">Sign up for a free trial</a>&nbsp;today.&nbsp;

<h2>Have I Been Hacked? How Do I Know?</h2>
There are various ways to tell whether hackers have access to your information:
<ul>
<li>Look for unusual activity on your account. This activity includes logins to your social media accounts from unfamiliar locations or mass messages sent from your email account.&nbsp;</li>
<li>Look for security emails from account providers that warn about failed login attempts or password changes you didn't make.&nbsp;&nbsp;</li>
<li>Look for changes in performance on the devices, apps, and websites you use. For example, see if videos take longer to buffer than normal.&nbsp;</li>
<li>Look at your browser's password manager (if you use one) and check that nobody has changed these credentials.&nbsp;</li>
</ul>
All the above can be a guessing game. You might have a feeling that you're the victim of a hack but don't know for sure. 
Checking a stolen password list like "Have I Been Pwned" clears up some of the confusion. This tool searches across multiple data breaches &mdash; when hackers take stolen passwords and usernames and post them online &mdash; to see if cybercriminals have compromised your personal information. 
Here's how to use this stolen password list:
<ol>
<li>Enter your email address on the main page.&nbsp;</li>
<li>Click "pwned."</li>
<li>The website will search thousands of databases to see if hackers have stolen your personal information.</li>
<li>If you receive the "Oh no &ndash; Pwned!" message, it means hackers have posted sensitive information associated with your email address (passwords, addresses, phone numbers, etc.) somewhere online.</li>
<li>If you receive the "Good news &ndash; no pwnage found!" message, it means the website could not find your information on the internet.&nbsp;</li>
</ol>
Note: Just because the website can't find your data on the internet, it doesn't mean hackers haven't compromised your personal information.
Read more:&nbsp;<a href="https://teampassword.com/blog/password-manager-for-small-businesses" target="_blank" rel="noopener">Password Manager for Small Businesses</a>

<h2>Which Passwords Did Hackers Steal?</h2>
Establish which passwords hackers stole in a data breach so you can take quick action. Websites like "Have I Been Pwned"&nbsp;won't&nbsp;tell you which passwords are at risk. You'll only learn whether hackers have compromised the data associated with a particular email address. 
Note: Sometimes, hackers might have access to your email address and other personal information but not your password. It's hard to know for sure.&nbsp;
If hackers have access to your data, it's a good idea to change&nbsp;all passwords&nbsp;associated with the compromised email address. If you use your email address for several online accounts, change the passwords for these services. Updating these passwords might take you a while, and remembering the new passwords leads to additional problems. (Keep reading to find a solution.)
Here are some other tips:
<ul>
<li>When choosing new passwords, use combinations of lowercase letters, uppercase letters, numbers, and symbols. Passwords that use all these elements are stronger than those that don't.</li>
<li>Don't write your passwords down because this increases the risk of identity theft.&nbsp;&nbsp;</li>
<li>Don't tell anyone your new passwords.</li>
</ul>
Read more:&nbsp;<a href="https://teampassword.com/blog/the-most-secure-way-to-share-passwords" target="_blank" rel="noopener">The Most Secure Way to Share Passwords</a>.

<h2>How Common Is a Data Hack?</h2>
More common than you think. Hackers were responsible for more than 4,000 attacks every day in 2020, and the total number of compromised records exceeded 37 billion. That's a 141% increase from 2019. Much of this compromised data appears on the dark web, where cybercriminals use it to facilitate illegal activities such as identity theft and money laundering.&nbsp;
If you have been the subject of a data hack, you are not alone. However, it's important to act quickly to prevent hackers from accessing your personal or financial accounts.&nbsp;
There are other types of cybercrime to consider. Cybercriminals use techniques like phishing, where they impersonate people online and trick victims into handing over their personal information. Phishing now accounts for more than 80% of all cybersecurity incidents, and criminals steal $17,700 every minute in these attacks.&nbsp;

<h2>What Kind of Information Do Hackers Steal?</h2>
Hackers steal all kinds of personal and financial information:
<ul>
<li>Names</li>
<li>Email addresses</li>
<li>Usernames</li>
<li>Passwords</li>
<li>Addresses</li>
<li>Phone numbers</li>
<li>Bank account details</li>
<li>Credit card numbers</li>
<li>Social Security numbers</li>
<li>Insurance information&nbsp;</li>
<li>IRS information</li>
<li>Photos</li>
<li>Private message</li>
<li>SMS messages</li>
</ul>
Nothing is off-limits for hackers, and these criminals go to great lengths to steal your data. Once they have access to the information above, hackers can transfer money from your bank accounts, use your identity to apply for financing, and damage your credit file.&nbsp;
Read more:&nbsp;<a href="https://teampassword.com/blog/the-scariest-data-breaches-of-all-time" target="_blank" rel="noopener">The Scariest Data Breaches of All Time</a>.
TeamPassword is the best password manager for teams. Features include two-step verification, password encryption, easy password sharing, and more.&nbsp;<a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">Get a free trial now</a>&nbsp;and learn how TeamPassword keeps you safe online.&nbsp;

<h2>Have I Been Hacked? How to Stay Safe.</h2>
There are several ways to improve online security and prevent hackers from accessing your personal information:
<ul>
<li>Use the latest security software and apps when using devices and browsing the internet.</li>
<li>Carry out regular risk assessments where you evaluate your security software.</li>
<li>Back up personal data to a reputable cloud service instead of keeping it on your device.&nbsp;</li>
<li>Don't share personal information with other people.</li>
<li>Create a security management strategy for your organization and share it with all team members.&nbsp;</li>
</ul>
Using a password manager is another way to stay safe online. The best ones encrypt your online passwords so hackers can't access these credentials, and you can keep passwords in a secure cloud-based vault and not have to remember them. There are various password managers online, including free ones available through most internet browsers, but not all tools are the same.&nbsp;
If you work alongside a team, consider TeamPassword. It's the&nbsp;<a href="https://www.teampassword.com/" target="_blank" rel="noopener">password manager for teams</a>&nbsp;that require world-class security and performance. This all-in-one password solution helps teams like yours store, manage, and share passwords in the safest way possible.&nbsp;

<h2>How Can TeamPassword Help?</h2>
TeamPassword prevents hackers from stealing your organization's most sensitive data with an incredible range of password management features. Enterprises of all sizes use TeamPassword to manage passwords, including tech startups, digital marketing agencies, creative agencies, and software and development teams.
Here are some&nbsp;<a href="https://teampassword.com/features" target="_blank" rel="noopener">TeamPassword features</a>&nbsp;that prevent situations involving a stolen password:
<ul>
<li>Random password generation that creates unique passwords for websites.</li>
<li>Two-step password verification.</li>
<li>Activity and logging tools so you can discover who has access to password management features.</li>
<li>Secure encryption technology.</li>
<li>Email notifications about password management actions.</li>
<li>Passwords stored securely in one place. </li>
</ul>
<h2>Final Word</h2>
If you're looking for the answer to the question, "Have I been hacked?" it's difficult to know for sure. Preventing hackers from compromising your data in the first place provides a better resolution. TeamPassword lets you store and manage passwords in a secure environment and minimize the effects of a stolen password so you can avoid hackers stealing your data and continue to collaborate on team projects.&nbsp;
With features like password encryption, two-step authentication, and random password generation, TeamPassword is the best password management solution for teams that want to improve online security.&nbsp;<a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">Sign up for a free trial</a>&nbsp;now.

Have I been hacked? Here's how to check if you have and learn how to stop hackers from stealing your data. | TeamPassword Blog

Have I been hacked? Here's how to check if you have and learn how to stop hackers from ...

TeamPassword Blog

Browse our carefully created articles about Information Security, Password Management, Product Information, and Modern Business, all written with your team's safety and success in mind.

Most popular articles

Business

November 14, 2021 ∙ 10 min read

10 extremely successful freelancers and what they do

Top 5 Dangerous Ways to Store Your Passwords

What is password encryption and how does it work?

Have I Been Hacked? How to Know for Sure.

Cybersecurity

September 21, 2021 ∙ 9 min read

What is a brute force attack and are you at risk?

Cybersecurity

September 14, 2021 ∙ 10 min read

Have I been pwned? What to do if it happens to you.

News

September 7, 2021 ∙ 6 min read

The First American Corporation Data Leak what happened?

Cybersecurity

September 7, 2021 ∙ 7 min read

Who is Mustang Panda and how can you protect yourself?

Cybersecurity

September 7, 2021 ∙ 6 min read

Who is Goblin Panda and how can you protect yourself?

Cybersecurity

September 7, 2021 ∙ 6 min read

Who is Gothic Panda and how can you protect yourself?

The Password Manager for Teams

Product

Support

Channels

Legal