Enzoic Navigation
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Enzoic APIs
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Enzoic APIs
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
Corporate Account Takeover

Corporate Account Takeover: What It Is, and What To Do

Stealing corporate credentials has been a popular tactic among cybercriminals for many years now. Due to reused passwords, blurred boundaries between personal and professional accounts, and an expanded remote workforce, cyber vulnerabilities are everywhere. 

What is Corporate Account Takeover? 

A Corporate Account Takeover (CATO) is a kind of organization-specific identity theft where cybercriminals steal employee passwords to gain access to information within the organization. 

Their targets include additional lists of employee credentials, financial information, and company data. Whether their goal is to employ malware or just have ongoing access to the company for nefarious reasons, the entry point is often a single compromised corporate credential. 

CATO attacks are becoming more sophisticated and more frequent. Successful attacks can lead to ransomware, wide-scale data breaches, and reputational damage. 

Who is a Target for CATO? 

Everyone is a target. 

Large, high-revenue companies like national banks or healthcare organizations are targets because their payoff–whether in terms of money or data– is often massive if hackers can complete a successful attack. 

However small- and mid-sized companies are targeted too. Cybercriminals are catching on to the fact that smaller organizations may not have the resources to have allocated cybersecurity protocols or IT team members to keep things locked down. 

CATO attacks are difficult to detect as criminals hack into accounts with legitimate credentials. Once inside the system, it’s easier for the hackers to leverage vulnerabilities, including escalating priveleges and data theft. 

What Attacks Can Lead to a CATO? 

How to cybercriminals get professional credentials in the first place? 

Brute Force Attacks 

Unfortunately there are many ways. There are lists–for free and for sale–of credentials on the dark web. Credentials compromised from third-party data breaches are well-known as a tool. Cybercriminals can obtain these lists to use Brute Force attack methods like credential stuffing. Bad actors will also use lists of weak and common passwords in password spraying attacks. 

Targeted Attacks 

They can also leverage the now common knowledge that most users reuse their passwords, often with minor changes to satisfy password complexity requirements. If a cybercriminal is able to obtain a users social media password, they can use the additional information gained from accessing that account to get more personally identifiable information like email addresses and work location. From there, it’s a simple step to look up someone’s professional email and see if they use the same password cross-account. 

Social Engineering 

There are additional ways cybercriminlas leverage social engineering too. Once in a system, a crimnal is able to pose as a trusted source from within the company. Requesting access, information, or sending other types of phishing emails is highly effective in these moments. 

Who Is Responsible for CATO Defense? 

In the past, organizations have blamed the use of compromised passwords on the account owners. In the same breath, many enterprises advise clients and employees not to reuse passwords; however, this education-based approach has not worked.

The main issue is that often, users do not have a way to know whether they are selecting a exposed password, whether they are creating a new password, or if compromise happens at some point down the line. 

Blocking compromised credentials is a reasonable and necessary defensive measure and is the businesses’ responsibility. The use of compromised credentials is now a well-established and available practice and needs to be part of an active cybersecurity posture. 

Steps to Take 

Businesses need to engage with contemporary cybersecurity issues like CATO to protect themselves, their employees, and their customers. To do so they can: 

1. Screen for compromised credentials at the point of creation and on an ongoing basis. 

2. Create strong password policies in line with NIST guidelines. 

3. Require MFA when possible.

account takeover protectionATOBrute Force Attackcredential screeningexposed passwords

Search

Assess your cyber vulnerabilities with a free password audit tool
Start Now

Browse blog categories

  • Account Takeover (30)
  • Active Directory (46)
  • all posts (165)
  • Continuous Password Protection (26)
  • COVID-19 (7)
  • Cracking Dictionaries (6)
  • Credential Screening (22)
  • Cybersecurity (80)
  • Data Breaches (37)
  • EdTech (4)
  • Enzoic News (19)
  • Financial Services Cybersecurity (6)
  • GovTech (4)
  • Healthcare Cybersecurity (15)
  • Law Firm Cybersecurity (2)
  • NIST 800-63 (30)
  • Password Security (44)
  • Password Tips (59)
  • Regulation and Compliance (13)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Developer Documentation (APIs)

Recent blog posts

  • How Stolen Credentials and Ransomware are a Simultaneous Threat
  • Password Tips for Your Employees
  • Bolstering AD Password Policies
  • [ Sign Up for a Free Account ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2022 | Privacy Policy | Acceptable Use

3800 Arapahoe Avenue, Ste 250 l Boulder, CO 80303

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website