Password Thievery Means It's Time to Change - Your Password - Electronic Health Reporter
Let’s assume for a moment that the passwords were encrypted and everybody changes their password today. What do the hackers have now? Email addresses – and lots of them – to attempt to run phishing scams or simply push spam, too. Either way could be a lucrative endeavor with that many addresses.
While there are many methods to improve security on user and customer accounts – such as two-factor authentication or pass phrases that need to be entered in addition to a password, they all rely on the website owner to require more than just a password on the front end. Just like encrypting data on the backend is something website owner must do. The consumer, in this case, can do nothing more to protect themselves other than change their password in a reactive method.
Also of interest in this case is a recent Forbes columnist noting that the story, predictably, caused panic as the story went viral. At this point in time, no other organization has been able to verify the theft besides the security firm that initially reported the breach, Hold Security. They are currently offering consumers an Identity Protection service, at a cost, to determine if their credentials were in fact stolen. Besides sending them money, you also need to provide your user email and password, albeit encrypted.
Could this be a case of a company creating a media hype just for their financial gain? No one knows for certain. For me, I will be busy the rest of the day changing my password on every site that I can remember registering on.