If you use Norton Password Manager, be on guard: Hackers have used automated password-guessing attacks to successfully break into around 8,000 users accounts.
NortonLifeLock began notifying customers about the intrusions earlier this month, according to a data breach notice sent to the Office of the Vermont Attorney General. The cybersecurity provider became aware of the problem on Dec. 12 when it detected an “unusually large volume of failed logins to customer accounts.”
“We determined that, beginning around December 1, 2022, an unauthorized third party had used a list of usernames and passwords obtained from another source, such as the dark web, to attempt to log into Norton customer accounts. Our own systems were not compromised,” the company wrote in the data breach notice.
In the worst case scenario, the hackers breached the user’s Norton Password Manager account, giving the culprits access to crucial login information. On Tuesday, NortonLifeLock’s parent, Gen Digital, told PCMag the hackers may have accessed 8,000 user accounts with Norton Password Manager by “credential stuffing," which usually involves automating the password guessing.
“We have been monitoring closely, flagging accounts with suspicious login attempts and proactively requiring those customers to reset their passwords upon login along with additional security measures to protect our customers,” Gen said. The company has already secured 925,000 accounts against the credential stuffing attacks.
Gen also suggested compromised users likely had their Norton Password Manager account originally secured with a re-used password. Hence, the incident is a reminder to protect your password manager account with a unique and long master password. You should also enable two-factor authentication to make it ever tougher for hackers to break in.