ISLAMABAD – Use of corporate emails to register for personal accounts on marketplaces and social media increases the risk of account theft and corporate security breaches, reveals the Kaspersky Digital Footprint Intelligence report.
Kaspersky analysed compromised credentials leaked on the dark web between 2019 and 2024 for three popular entertainment platforms: Roblox, Discord and Netflix.
On average, 7 per cent of users whose accounts were leaked had registered on these platforms using a corporate email address.
“Registering on various services for personal use with a work email is not best practice. First, you may lose access to these accounts if you change jobs. Second, it can pose security risks for both you and your company. Suppose your passwords follow a predictable pattern across different services. In that case, it increases the likelihood of other accounts being compromised, including your work account, should your corporate email be exposed in a dark web leak,” explains Sergey Shcherbel, expert at Kaspersky Digital Footprint Intelligence.
Kaspersky experts also found that bank employees most commonly registered their work email addresses on streaming services, marketplaces and social networks. In a few cases, corporate emails were also used as logins on gaming platforms and adult content websites.
To conduct this study, experts compiled a sample of 50 banking sector companies and examined compromised credentials leaked on the dark web, identifying those linked to the corporate domains of these companies across five categories of popular platforms.
In light of these growing infostealer threats, Kaspersky has launched a dedicated landing page to raise awareness of the issue and provide strategies for mitigating associated risks.
If you encounter a data leak through infostealers, change compromised account passwords and monitor for suspicious activity associated with those accounts. Run full security scans on all devices, removing any detected malware.
Companies are recommended to monitor dark web markets proactively to detect compromised accounts before they pose risks to customers or employees.
