24 million records lost to hackers – wow! That’s equal to the entire population of New York, Los Angeles, Chicago, and the rest of the top 10 cities in the U.S. combined.
Everyone seemed to breathed a big sigh of relief when Tony Hsieh, CEO of Zappas, shared [LA Times story] that the hackers had stolen just about everything but the full credit card numbers of the victims [they captured just the last 4 digits].
But don’t be so quick to let Zappos off the hook. This is still epic in three significant ways.
First, most people use their email address for their user name for every account they have. With most web sites recommending a strong password, including upper and lower case characters, a number, and a symbol – few people are willing or able to remember more than one password, so they use the same password for every account. Now, the hackers have that one password for 24 million people. Effectively, the hackers now have the login passwords to every account that most of these millions of people had. The hackers will now use automated and intelligent methods to find many of the accounts of the victims and gain access to them unless the passwords are changed.
Second, there are databases of stolen credit card numbers for sale. Now that the hackers have the full name, address, phone number, and last four digits of the credit card, they can do some computer-driven matching and make much better use of the previously stolen credit card data.
Three, this puts everyone at risk. Once the hackers have the email and social media accounts of the victims who are your friends, they can approach you under the guise of being the fiend you trust and try to extract useful information to attack you.
Actions Items: If you are a Zappos customer – stop reading now and change every password you have that matches your Zappos password, keep a closer watch on any credit cards you used with Zappos, and never let any merchant store your credit card information.




