Most hacked passwords revealed as UK cyber survey exposes gaps in online security

• NCSC’s first ‘UK Cyber Survey’ shows 42% of Brits expect to lose money to online fraud
• Breach analysis finds 23.2 million victim accounts worldwide used 123456 as password
• Global password risk list published to disclose passwords already known to hackers
• NCSC urges using 3 random words as passwords on the eve of CYBERUK 2019 event

BRITS have been urged to apply steps to stay safe online after results of the UK Cyber Survey exposed exploitable gaps in their personal security knowledge.

The polling was independently carried out on behalf of the National Cyber Security Centre (NCSC), a part of GCHQ, and Department for Digital, Media and Sport (DCMS).

The findings, released ahead of the NCSC’s CYBERUK 2019 conference in Glasgow this week, will inform Government policy and the guidance offered to organisations and the public. 

The cyber summit will see a range of sessions delivered by industry, academia and government, including a keynote speech by Cabinet Office Minister David Lidington.

Amongst the results – which have been published in full on www.ncsc.gov.uk - were that;

• Only 15% say they know a great deal about how to protect themselves from harmful activity
• The most regular concern is money being stolen – with 42% feeling it likely to happen by 2021
• 89% use the internet to make online purchases – with 39% on a weekly basis 
• One in three rely to some extent on friends and family for help on cyber security
• Young people more likely to be privacy conscious and careful of what details they share online
• 61% of internet users check social media daily, but 21% report they never look at social media
• 70% always use PINs and passwords for smart phones and tablets
• Less than half do not always use a strong, separate password for their main email account

The NCSC has also today published separate analysis of the 100,000 most commonly re-occurring passwords that have been accessed by third parties in global cyber breaches. 

The results show a huge number of regularly used passwords breached to access sensitive information.

Dr Ian Levy, NCSC Technical Director, said:

“We understand that cyber security can feel daunting to a lot of people, but the NCSC has published lots of easily applicable advice to make you much less vulnerable.

“Password re-use is a major risk that can be avoided - nobody should protect sensitive data with somethisng that can be guessed, like their first name, local football team or favourite band.

“Using hard-to-guess passwords is a strong first step and we recommend combining three random but memorable words. Be creative and use words memorable to you, so people can’t guess your password.”

Margot James, DMCS’ Digital and Creative Industries Minister, said: 

"Cyber security is a serious issue, but there are some simple actions everyone can take to better protect against hackers.

“We shouldn't make their lives easy so choosing a strong and separate password for your email account is a great practical step. 

“Cyber breaches can cause huge financial and emotional heartache through theft or loss of data which we should all endeavour to prevent."

David Lidington, Chancellor of the Duchy of Lancaster and Minister for the Cabinet Office, said: 

"Given the growing global threat from cyber attacks, these findings underline the importance of using strong passwords at home and at work. 

"This is a message we look forward to building on at CYBERUK 2019, an event that reaffirms our commitment to make Britain both the safest place in the world to be online and the best place to run a digital business." 

The NCSC hope to reduce the risk of further breaches by building awareness of how attackers use easy to guess passwords, or those obtained from breaches and help guide developers and System Administrators to protect their users.

The compromised passwords were obtained from global breaches that are already in the public domain having been sold or shared by hackers.

The list was created after breached usernames and passwords were collected and published on Have I Been Pwned by international web security expert Troy Hunt. The website allows people to check if they have an account that has been compromised in a data breach.

Troy Hunt said: 

“Making good password choices is the single biggest control consumers have over their own personal security posture.

“We typically haven’t done a very good job of that either as individuals or as the organisations asking us to register with them.

“Recognising the passwords that are most likely to result in a successful account takeover is an important first step in helping people create a more secure online presence.”

Notes to Editors

• The NCSC‘s two-day CYBERUK 2019 conference will see 2,500 delegates come to Glasgow’s Scottish Exhibition Centre on 24 and 25 April for a range of speeches, workshops and interactive displays.
• The conference is the flagship event for the tech community in the UK and includes participation from Government, industry and academia sharing knowledge to help make the country the safest place to live and do business online.
• the Government’s Cyber Aware campaign on online safety here.
• The survey was commissioned by the National Cyber Security Centre and Department for Digital, Culture, Media and Sport as part of the UK Government’s National Cyber Security Programme. Ipsos MORI were commissioned to carry out the research.
• The findings will inform Government policy and the guidance which is offered to organisations and the public on a range of cyber security issues, as part of making the UK the safest place to live and do business online.
• Over 2,500+ respondents aged 16+, businesses and charities were surveyed from late November 2018 to January 2019 via telephone.

Password breaches

• The 20 most commonly occurring names used as passwords in breaches;

• The full ‘table’ of Premier League football teams whose name was used to breach accounts;

Cyber Survey – some of the findings

Almost half (46%) agree that most information about how to be secure online is confusing, though this falls to 18% who agree strongly.

The most pressing security-related considerations for people online are protecting their privacy and avoiding money being stolen

The proportions who feel they will be a victim of cyber crime in the next two years range from 12% having information stolen and a ransom demanded, through to 42% who feel they will have money stolen which is later reimbursed.  

Only 51% feel that apps being accessed without consent will have a big personal impact whilst 91% feel having money stolen without reimbursement would have a big impact.

Just over one in three agree that losing money or personal details over the internet is unavoidable these days, though only 15% strongly agree

One in three rely to some extent on friends and family for help on cyber security