Data of More Than 600,000 Email.It Users Has Been Hacked and Sold on the Dark Web

Data breaches have been a constant plague on the IT industry for a long time now. It seems that there's not a week that passes without news of another critical one being reported by a major company, such as Equifax or Decathlon. But what's arguably worse is that those that are reported are not by any means the only ones that are happening. No, as a matter of fact, the majority of data breaches these days are not reported and are only made known to the wider public when the party responsible for the attack leaks or tries to sell the stolen information on the dark web. This is precisely what happened with the Email.it data breach.

It appears that way back in January 2018 the Italian email provider suffered an attack that left the data of more than 600,000 of its users in the hands of the cybercriminals responsible for it. And we're not talking about superficial data either – this included passwords, other security details, account details, emails, attachments of said emails, billing addresses, etc.

Predictably, the hackers first tried to extort "a little bounty" out of the company, but to their credit Email.it refused it and went to the police with information of the attack. What's not to their credit, however, is the fact that the company took so long to admit that the breach even happened to the people who could suffer the most from the event – the Email.it users.

"Unfortunately, we must confirm that we have suffered a hacker attack" is hardly the most reassuring thing Email .it could have said, but it could be argued that it needed to be said to the users as soon as possible, not years after the breach had happened, and months and months after it was discovered, after a failed extortion attempt and after all the stolen data was already released on the dark web, for the modest asking price of 0.5 Bitcoin.

To quote US Senator Tom Carper, "When hackers are able to obtain someone's personal information, the consequences are real." This represents a view of many current legislators, more and more of who are waking up to the problem of the lack of proper legislature that accounts for such occurrences. The push to ensure justice is meted out not only to those who would commit cybercrime but to those who cover it up and thus create dangerous situations seems to be gathering momentum.

CEOs of tech companies have been catching a lot of flak over similar issues from politicians. The perfect example of this is US Senator Maggie Hassan accusing Equifax that "You're doing things [only] after a major breach." And she does seem to have a point – it's a company's responsibility to keep the information entrusted by its customers safe, and out of the grubby hands of internet ne'er-do-wells.

Unfortunately, companies are all too often negligent in the fulfillment of this duty – and now Email .it has joined the ranks of those that have been found wanting. And after the gaffe is revealed, the excuse always seems to be the same story about how the stolen information wasn't really all that crucial, since the financial details of the customers were stored on another server or something.

So What can Email.it Users do to Keep Themselves Safe?

Well, seeing as how all the information that Email.it users had stored on the site is already out there, they must assume that anything they had on that account could be used against them. They would do well to monitor any and all activities related to that account very carefully.

It is advisable that Email.it users check their contacts and correspondence for anything untoward. Additionally, it is recommended that all Email.it users immediately change their passwords, as well as the passwords of any other site that they used their Email.it addresses as an alternative or recovery email. Needless to say, other accounts that share the same passwords, because there are likely to be some in spite of all recommendations, should likewise be updated with fresh passwords post haste. It is also advisable that threatened users enable multi-factor authentication on their accounts whenever the feature is available, just to make sure their accounts are safe.