--- title: '99.9% of Compromised Accounts Do Not Use Multi-Factor Authentication' url: 'https://blog.datum-consulting.com/blog/99-percent-compromised-accounts-dont-use-multifactor-auth' markdown: 'https://blog.datum-consulting.com/blog/99-percent-compromised-accounts-dont-use-multifactor-auth.md' date: '2020-03-09' description: 'At the RSA security conference the last week of February, Microsoft engineers said that 99.9% of the compromised accounts they track every month don’t use multi-factor authentication, a solution that stops most automated account attacks. The cloud giant said it tracks more than 30 billion login eve…' taxonomy: category: - blog tag: - cybersecurity - hacker - 'cyber criminal' - passwords - 'multi-factor authentication' month: - March archives_month: - mar_2020 archives_year: - '2020' --- # 99.9% of Compromised Accounts Do Not Use Multi-Factor Authentication [ Home ](https://blog.datum-consulting.com/) 99.9% of Compromised Accounts Do Not Use Multi-Factor Authentication ## [99.9% of Compromised Accounts Do Not Use Multi-Factor Authentication](https://blog.datum-consulting.com/blog/99-percent-compromised-accounts-dont-use-multifactor-auth) 9th Mar 2020 [cybersecurity](https://blog.datum-consulting.com/tag:cybersecurity#body-wrapper) [hacker](https://blog.datum-consulting.com/tag:hacker#body-wrapper) [cyber criminal](https://blog.datum-consulting.com/tag:cyber%20criminal#body-wrapper) [passwords](https://blog.datum-consulting.com/tag:passwords#body-wrapper) [multi-factor authentication](https://blog.datum-consulting.com/tag:multi-factor%20authentication#body-wrapper) At the [RSA security conference](https://www.rsaconference.com/usa/agenda/breaking-password-dependencies-challenges-in-the-final-mile-at-microsoft) the last week of February, Microsoft engineers said that 99.9% of the compromised accounts they track every month don’t use [multi-factor authentication](activate-two-factor-authentication), a solution that stops most automated account attacks. The cloud giant said it tracks more than 30 billion login events per day and more than one billion monthly active users. Microsoft said that, on average, around 0.5% of all accounts get compromised each month, a number that in January 2020 was about 1.2 million. While all account hacks are bad, they are worse when the account is for enterprise use. Of these highly sensitive accounts, only 11% had a multi-factor authentication (MFA) solution enabled, as of January 2020, Microsoft said. In most cases, the account hacks happen after rather simplistic attacks. The primary sources of most hacks of Microsoft accounts was password spraying, a technique during which an attacker picks a common and easy-to-guess password, and goes through a long list of usernames until they get a hit and can access an account using said password. ![](https://blog.datum-consulting.com/blog/99-percent-compromised-accounts-dont-use-multifactor-auth/rsa-msft-password-spray.png "Source: Microsoft")Source: Microsoft The second source of account hacks, Microsoft said, was [password replays](password-reuse-for-disney-hack), a technique that involves an attacker taking credentials leaked at another company and then trying the same credentials on a Microsoft account, hoping the user reused usernames and passwords. “We know that 60% of users reuse passwords. It’s super common,” said Lee Walker, Identity and Security Architect at Microsoft. “Don’t be confused. People reuse their enterprise accounts in non-enterprise environments.” ![](https://blog.datum-consulting.com/blog/99-percent-compromised-accounts-dont-use-multifactor-auth/rsa-msft-password-replay.png "Source: Microsoft")Source: Microsoft Walker said that the vast majority of password spraying and password replay attacks that take place on Microsoft’s infrastructure are carried out and target older legacy authentication protocols, such as SMTP, IMAP, POP, and others. More precisely, 99% of all password spraying attacks and 97% of password replay attacks are carried out via legacy authentication protocols. The reason, according to the cloud giant, is that these legacy authentication protocols don’t support MFA solutions, making them ideal for hackers. Companies that leave these legacy authentication protocols enabled for their cloud systems and networks are exposed to attacks and should disable them as soon as possible. Per Microsoft, results are palpable, and they’ve seen a 67% reduction in account compromises for tenants who disable legacy authentication protocols. However, according to Microsoft, the first step for every company should be to enable an MFA solution for user accounts, first and foremost. Microsoft has been telling companies and users alike to enable an MFA solution since last year, claiming that using an MFA solution – whatever that may be, hardware key, SMS, etc. – [blocks 99.9% of all account hacks](https://www.zdnet.com/article/microsoft-using-multi-factor-authentication-blocks-99-9-of-account-hacks/). [ Previous Post](https://blog.datum-consulting.com/blog/firewalls-vital-protecting-networks-data) [Next Post ](https://blog.datum-consulting.com/blog/future-of-wifi6-and-5g) #### Related Posts - 100 [The Most Hacked Passwords Around the World](https://blog.datum-consulting.com/blog/most-hacked-passwords "The Most Hacked Passwords Around the World") - 100 [Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard to Accelerate Availability of Passwordless Sign-Ins](https://blog.datum-consulting.com/blog/passwordless-sign-ins "Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard to Accelerate Availability of Passwordless Sign-Ins") - 100 [How Hackers Get Your Passwords and How To Defend Yourself](https://blog.datum-consulting.com/blog/hackers-get-passwords "How Hackers Get Your Passwords and How To Defend Yourself") - 100 [How to Keep Your Company Safe from Russian Hacks](https://blog.datum-consulting.com/blog/russian-hacks-safety "How to Keep Your Company Safe from Russian Hacks") - 100 [Data Privacy Week: 6 Best Practices for Your End Users](https://blog.datum-consulting.com/blog/data-privacy-week "Data Privacy Week: 6 Best Practices for Your End Users") [JOIN OUR NEWSLETTER](https://zc.vg/sf/bawK1) [PAY INVOICE ONLINE](https://datum.connectboosterportal.com/authentication/login) [![](https://blog.datum-consulting.com/modules/sidebar/Yubico.png)](https://www.pntra.com/t/SkNJTk5MT09DSEZMTExNQ0dPR0tNSw) #### Follow Us [](https://twitter.com/datumconsulting "Twitter")[](https://www.linkedin.com/company/datum-consulting/ "LinkedIn") "); #### Popular Tags #### Archives - [ 3 May 2022 ](https://blog.datum-consulting.com/archives_month:may_2022) - [ 3 March 2022 ](https://blog.datum-consulting.com/archives_month:mar_2022) - [ 3 February 2022 ](https://blog.datum-consulting.com/archives_month:feb_2022) - [ 2 January 2022 ](https://blog.datum-consulting.com/archives_month:jan_2022) - [ 1 December 2021 ](https://blog.datum-consulting.com/archives_month:dec_2021) - [ 2 November 2021 ](https://blog.datum-consulting.com/archives_month:nov_2021) - [ 2 October 2021 ](https://blog.datum-consulting.com/archives_month:oct_2021) - [ 1 September 2021 ](https://blog.datum-consulting.com/archives_month:sep_2021) - [ 3 August 2021 ](https://blog.datum-consulting.com/archives_month:aug_2021) - [ 2 July 2021 ](https://blog.datum-consulting.com/archives_month:jul_2021) - [ 4 June 2021 ](https://blog.datum-consulting.com/archives_month:jun_2021) - [ 2 May 2021 ](https://blog.datum-consulting.com/archives_month:may_2021) --- ## Navigation - Parent: [Home](https://blog.datum-consulting.com/index.md) - Previous: [The Future of Connectivity with WiFi 6 and 5G](https://blog.datum-consulting.com/blog/future-of-wifi6-and-5g.md) - Next: [Sophisticated Firewalls Are Vital for Protecting Networks and Data](https://blog.datum-consulting.com/blog/firewalls-vital-protecting-networks-data.md)