Keap Customer's Accounts Compromised (Limited Accounts) Due To Password Sharing
Keap Notifies Clientbase of Limited Account Compromises
On October 26th, Keap notified its customer-base via email and official user groups of the security incident involving limited account compromises. Further to the notification, Keap's security team also shared some common best practices that its client base should put in place to help reduce the risk of similar incidents happening.
It is important to note that Keap's customers' accounts were accessed due to password sharing. The cyber incident occurred when a number of Keap's customers who had shared their passwords had their login credentials used by an unknown third party. The sharing of log-in credentials is a violation of Keap's rules and our advice is to never share your credentials with third parties.
Furthermore, it's important to add, that Keap (formally Infusionsoft), just like all quality companies, invests heavily in protecting itself and its clients from cybercrime. Unfortunately, as we explained in the above video, human error still plays a vital role in cybercrime (90%+ cyber crimes are a result of human error).
This may have well been the case here with Keap also.
Keap will continue to monitor the situation around the clock, and I'm sure there will be further updates to follow. DarkXposed recommends that all Keap users monitor their emails, the Keap website and join the official Keap user-group to keep updated with the latest news.
DarkXposed would like to offer all Keap users a complimentary cyber intelligence check to identify if you and your business has any credential exposure on the dark web.
Keap Users: Are Your Credentials Compromised?
As cyber threats continue to evolve, cybercriminals are becoming more and more focused on compromising your business credentials. This method is often refered to as business email compromise.
Regardless, Keap users and business owners alike need to ensure that they have ample security measures along with cyber intelligence measures in place. The Keap customer accounts compromise has taught us that business owners need to be more vigilant.
Basic security measures include:
- Don't Share User Credentials: Keap strongly recommends against sharing login credentials, even with trusted partners.
- Change Your Password: Keap initiated a forced password reset for all users. They suggest passwords should be robust, incorporating a mix of characters and unique from previous passwords.
- Enable Two-Factor Authentication: Keap also advised enabling two-factor authentication for an extra layer of security.
But these are just the basics, the beginning. It's our view that if your operating a business that holds a variety of data that you should also invest in Cyber Intelligence.
About DarkXposed
Our intelligence solution DarkXposed is unique, as it works with multiple independent enterprise-level PIAs threat intelligence units (TIUs) globally to provide an aggregated intelligence awareness outcome for our clients.
Rather than relying on one or two PIAs, DarkXposed leverages multiple PIAs/TIUs which significantly increases the chances of discovering compromised credentials for our wide variety of clients.
Furthermore, we work as a co-managed solution to support and provide your internal team, along with your clients and external IT cybersecurity advisors with 24/7 live monitoring of the dark web.
Note: Our Threat Intelligence Units (TIUs) monitor your business domain, email addresses and key clients and suppliers – looking for exposed credentials that we can find – that are up for sale on the dark web.
Keap Users: Have Hackers Stolen Your Keap Login Credentials?
Keap Users: If you're concerned that cybercriminals may have stolen your login credentials or be targeting you then DarkXposed's 'Cyber Intelligence Check' is the perfect solution. Let us search the deep corners of the Dark Web for you, and notify you if any of your emails, passwords and other important information is currently up for sale.
NOTE: The below form may take up to 10 seconds to load. Please be patient.
Compliance Assurance on Business Domain Credentials Exchange
At DarkXposed, we respect and understand the critical nature of privacy and data protection in our professional relationships. In the context of our collaboration involving your organization, your clients, and your suppliers, we want to assure you that we strictly comply with all privacy regulations, including GDPR.
The exchange of business domain credentials, such as the '@xyzcompany.com' addresses for your organization, your clients, or your suppliers, does not constitute a violation of privacy or GDPR regulations. This information is categorized as business contact data, distinct from personal data, and sharing such information is considered a standard and compliant practice in professional interactions.
Please note, we do not require nor request personal or sensitive information such as passwords, usernames, dates of birth, or any other information that may be classified as personal or sensitive under GDPR guidelines. Our commitment is to protect the integrity and confidentiality of all shared data, rigorously adhering to all applicable laws and standards.
Your trust is important to us, and we want to assure you that we handle all operations involving the exchange of business domain credentials with the utmost care. If you have any further concerns or questions about our data protection practices, we encourage you to contact our dedicated compliance team.
Your business and its privacy is safe with DarkXposed - Cyber Risk Intelligence.
Cyber Risk Intelligence Pty Ltd
Limitations of Service: It is not possible for Cyber Risk Intelligence or DarkXposed to discover all compromised credentials or to guarantee other services as being 100% correct. For best results, all services should be used ONLY to help support accepted 'best practice' cyber security procedures.
Terms | Privacy
Copyright 2023 | All Rights Reserved