Spark spots thousands of passwords on dark web
Spark has warned 21,000 customers that it has found email addresses and passwords for their MySpark accounts being passed around on the ‘‘dark web’’.
Spokeswoman Ellie Cross said Spark had not been hacked and had only spotted suspicious activity on fewer than 50 of the accounts.
The reason people’s account details would have leaked online was because they had used the same email addresses and passwords for other online services that had been compromised in hacks on other companies in the past, she said.
It is not unusual for people to share log-on credentials and then find them circulating on the web as a result of past, huge hacks.
Forbes magazine estimated last year that there were 1.4 billion such credentials circulating on the dark web, which could provide access to many billions of separate accounts for different online services.
Cross said the log-in details and passwords that would give access to the 21,000 MySpark accounts were found among two lists, ‘‘one with billions of credentials, and one with millions of credentials’’.
‘‘This is part of a much wider issue that goes far beyond Spark,’’ she said.
Security experts suggest people use different log-ins and passwords for each online service they use.
Spark sent an email to all of the 21,000 customers, saying the company had detected suspicious activity on their accounts and telling them to reset their passwords.
But Cross said it had in fact only detected suspicious activity on fewer than 50 of the accounts, and Spark had no evidence MySpark accounts were specifically targeted.
‘‘We were keen for people to reset their passwords quickly so we sent out an automated email with that wording,’’ she said.
Cross defended giving people that scare. ‘‘We think our priority is to protect our customers so we chose to send out an email promptly and then follow up with an explanation.’’
MySpark accounts provide access to people’s billing information, including their names and the phone numbers they have called, but do not provide access to people’s emails.
Spark had scanned the dark web for credentials that would provide access to MySpark accounts to help customers improve their security, Cross said. ‘‘It was a general, proactive sweep – part of a positive attempt to protect our customers.’’