Data breach-Rick Stealer Logs DB

Cougar

Dear F‑Secure,

I regularly receive notifications from you regarding data breaches involving my information. I appreciate these warnings – it’s good to be informed.

However, I find it unclear which password or service you are referring to when you recommend changing a password.

For example, in a recent alert, “Rick Steale Logs bc” was mentioned. I have no idea what this refers to, and as far as I know, I have never had an account or password associated with it.

Could you please clarify how I can determine whether this is something I should be concerned about? And what steps I should take in such a case?

Kind regards,

Geert Beulen

IMG_5658.jpeg

Firmy

Hello @Cougar

Thank you for your patience. We understand your concern about the clarity of these alerts, especially when the source isn't immediately recognisable. We appreciate you bringing this to our attention.

Regarding the "Rick Stealer Logs DB" alert you received, we understand why this might be confusing. To clarify, "Rick Stealer Logs DB" is not a specific service or account you would have signed up for. Instead, it refers to a database that have been stolen by various "infostealer" malware and is being privately shared online.

These databases are similar to "combolists" and are created by aggregating data from different infostealers. While the database itself might have a unique name like "Rick," this name is associated with the compiled data, not necessarily a specific new infostealer malware family. In most cases, we don't have additional details about the original infection or the specific malware family involved.

Even if you don't recognise "Rick Stealer Logs DB," the primary concern highlighted is password reuse. The presence of your email address and a corresponding password in this database indicates that a password you've used for some service has been compromised and is actively being shared.

Here's why this is serious and what we strongly recommend:

• Compromised Password: The password found in the Rick Stealer Logs DB is compromised. If you have used this same password (or variations of it) on any other online service, those accounts are now vulnerable. Attackers can use automated tools to try these stolen credentials across various popular websites.
• Password Reuse is a Major Risk: This type of breach often impacts even sophisticated users because of password reuse. Even a few characters of your password being known can help an attacker crack the entire password.
• Active Monitoring for Suspicious Activity: All services where you've used variations of this compromised password should be closely monitored for any suspicious activity.

Therefore, the crucial steps you should take are:

1. Change the Compromised Password immediately: The password associated with your email in the "Rick Stealer Logs DB" needs to be changed. Crucially, do not reuse this password for any other service, and ensure the new password is strong and unique.
2. Identify and Change Reused Passwords: Think about where you might have used that same password, or very similar variations, across other online accounts. You must change those passwords as well to something unique.
3. Use a Password Vault: We highly recommend using Password Vault. This feature helps you create and store unique, strong passwords for every single online account, making it much easier to manage them and significantly reducing your risk from breaches like this.
4. Enable Two-Factor Authentication (2FA): Where available, enable two-factor authentication (2FA) on all your online accounts. This adds an extra layer of security, making it much harder for an attacker to access your accounts even if they have your password.

While we understand it's frustrating not to know the exact service that was initially breached, the most effective defence against "infostealer" breaches is proactive password hygiene.

We hope this explanation provides you with more clarity. Please don't hesitate to reach out if you have any further questions or require assistance with these steps.

Thank you and have a lovely day.

Firmy

Hello @Cougar

Welcome to the F-Secure Community, and thanks for your post.

We'd be happy to help you get more details about that breach alert. To do so, we'll need a bit more information from you, so I've sent you a private message to collect those details.

In the meantime, you can find a comprehensive guide on what to do when F-Secure ID Monitoring detects a breach right here: [Cyber Help] F-Secure ID Monitoring found a breach, what should I do?

Thank you, and have a lovely day.