Last week it was reported that a small group of Russian computer hackers illegally obtained an unprecedented quantity of internet credentials, including 1.2 billion username and password combinations, and over 500 million unique email addresses. The compromised companies have not yet been identified, but it is believed that the information came from over 420,000 websites. While the size of this particular breach is unparalleled, news of yet another data security breach does not come as much of a surprise. What is concerning, however, is how unsophisticated and common the tactics used were, and the number of companies that still remain vulnerable to such attacks.

The Russian crime ring reportedly, at least in part[1], used what is known as the SQL injection (“SQLi”) method, a very well-known hacking technique. SQL is a computer language that is used to send queries to databases. It is used, for example, in username and password fields on websites. The coding in these fields commands the website’s database to search for the stored username and password; if both match, the website allows the user access. The problem with this type of SQL coding is that it can be difficult to prevent a site visitor from inputting information other than usernames and passwords. An attacker can therefore “inject” malicious code into the input boxes that allow the hackers to download entire databases of information. The risk of SQLi has dramatically risen with the proliferation of automated tools, which allow hackers to attack many websites at once with ease, instead of having to manually enter malicious code into each site.