Experts Comments On Orvis.com Leaked Internal Passwords On Pastebin

Krebs is reporting that Orvis, a Vermont-based retailer that specializes in high-end fly fishing equipment and other sporting goods, leaked hundreds of internal passwords on Pastebin.com for several weeks last month, exposing credentials the company used to manage everything from firewalls and routers to administrator accounts and database servers, KrebsOnSecurity has learned. Orvis says the exposure was inadvertent, and that many of the credentials were already expired.

https://krebsonsecurity.com/2019/11/retailer-orvis-com-leaked-hundreds-of-internal-passwords-on-pastebin/

Experts have commented below.


EXPERTS COMMENTS
Jonathan Deveaux, Head of Enterprise Data Protection,  comforte AG
November 13, 2019
Orvis is fortunate that no reports of customer data were leaked.
Each newly reported data breach or data exposure incident brings to light how much access some employees have, and also, what are some not-so-well-known places where exposed data or credentials may show up (Pastebin?). Some privileged employees may certainly have a need or directive to possess ‘keys to the technology kingdom.’ They may also find it challenging to keep the dozens of user names and passwords securely managed, yet accessible, to perform their day-to-day responsibilities. But it is clear that organizations need additional data protections beyond access safeguards to ensure their ‘crown jewels’ are kept secured. Orvis is fortunate that no reports of customer data were leaked, as this 160-year-old retailer may have had to answer data privacy questions as cited in several regulations in jurisdictions in which they do business.
James McQuiggan, Security Awareness Advocate,  KnowBe4
November 13, 2019
It is more effective to have a proper password management system for organisations.
Keeping track of passwords within the business gets complex when you’re using local accounts. It’s important to have a centralised identity and access management system to protect not only user accounts, but also devices like routers, switches and firewalls. Using local or shared accounts requires some type of repository to store the credentials and when these are accidentally posted in uncontrolled environments, it can open opportunities for unauthorised use, which can lead to intellectual property theft, identify theft or business email compromise. If a central repository needs to be used, it is more effective to have a proper password management system for organisations that is protected on the network and only accessible by authorised users.

If you are an expert on this topic:

Dot Your Expert Comments

SUBSCRIBE to alert when new comments are posted on this news. :



Join the Conversation

Join the Conversation


In this article