Everybody knows that a strong password is very important. However, I can't find any citable public example of any kind where a user or users suffered a heavy loss from using bad passwords, or their service provider handling them badly.

  • 1
    You really cannot find examples where the service provider handled passwords badly? How about doing some simple search? – Steffen Ullrich Apr 6 '16 at 15:38
  • 1
    I may have been unclear: I am not looking only for leaks, but an estimated or even the actual value of damages done. – Peter Dam Apr 6 '16 at 15:40
  • 1
    Big famous leaks from Adobe, Playstation, Ashley Madison, etc all come to mind... Estimates of damages done in $$ is very likely not public (but I'm sure you can pay any number of consulting firms to do these estimates for you). – Mike Ounsworth Apr 6 '16 at 15:41
  • 1
    Sony is a pretty good example for one, thanks! They got fined for £250,000, and the free game compensations must have also been a bit costly. – Peter Dam Apr 6 '16 at 15:48
  • The problem with measuring losses from password breaches is that they're not reported. A stolen password often compromises another account elsewhere, which makes it hard to track the initial breach point unless it's highly publicised. There's also the reselling market for personal information to consider, where consumer costs are even less measurable. You're much better off looking at data breaches in terms of cost-to-business, particularly in relation to regulatory fines (e.g. fines handed out by the ICO in the UK), without limiting yourself to breaches of passwords. – Polynomial Apr 6 '16 at 15:51

There was a study conducted by the Ponemon Institute and IBM in 2015 which estimated that the average information breach costs a business $3.79M, with an additional $1.57M in reputational damage.

Source: http://www.csoonline.com/article/2926727/data-protection/ponemon-data-breach-costs-now-average-154-per-record.html

However, it's really hard to determine whether these are caused purely by password security, or whether the incident was caused by some other vector of badness. There's one identifiable case of a bad password being used to cause reputational damage to NATO countries here:



Wikileaks wents through a lot of effort to redact the diplomatic cables. They also released an a big insurance file that contained all of the unredacted diplomatic cables in an encrypted container. Unfortunately they reused a password for this purpose that Wikileaks also used when sharing files with the Guardian. David Leigh, a journalist of the Guardian then published that password in his book about Wikileaks not knowing that the password is the password for the insurance file.

A bit earlier Daniel Domscheit-Berg and other individuals left Wikileaks. In the process of leaving Wikileaks they took the database of documents with them. Among them alledgly the No Fly List and a huge trove of documents from Bank of America.

Julian Assange demanded that they give the data back to Wikileaks. Daniel and people around him argued that Julian Assange and the current Wikileaks team weren't capable of keeping the data safe. A bit later Daniel or people around him allegedly told a newspaper about the fact that the password published in the book of the Guardian journalist is indeed the password for the insurance file.

This inturn lead to the data about the diplomatic cables being out their in the open in an unredacted fashion. Wikileaks then decided to publish everything in an redacted form. Names of sources in the diplomatic cables became public. Daniel and the people who left Wikileaks then reportedly decided to delete the trove of data they took with them and the Bank of America data never saw the light of day. The whole fiasco produced a lot of bad will with Daniel Domscheit-Berg being thrown out of the Chaos Computer Club.

It's a story of how even people who are highly versed in computer security can still get password management wrong with grave consequences.

  • 1
    This is a great answer ... but completely unrelated to the question. A history of wikileaks does not answer a question about the dollar value of corporate damages as a result of weak passwords. – Mike Ounsworth Apr 6 '16 at 19:39
  • 1
    @MikeOunsworth : The question as it exists doesn't speak about "corporate damage", so it's irrelevant whether my answer addresses concerns about "corporate damage". – Christian Apr 6 '16 at 19:46
  • This comment and this comment make it clear that he's interested in hard numbers for monetary damages (though you're right about "corporate", I inferred that) – Mike Ounsworth Apr 6 '16 at 19:50
  • I see no evidence that he's only interested in monetary damages. People in Iran who gave the US information and had their names in the cables certainly suffered damages from their identity being public because of the password management in this case. – Christian Apr 6 '16 at 19:55
  • 1
    Monetary damages are certainly one kind of damage that's important, but I see no reason why it should be the only one of interest. The original question doesn't specify that only one kind of damage counts. That said the monetary value of the US state department losing all the names of sources they wrote into their cables is likely substantial even if it's hard to estimate. – Christian Apr 6 '16 at 20:04
