Chapter Eleven: Hackers using Ashley Madison passwords to hack Paypal accounts?

Update: 14.9%, or 8,643 of the 57,819 unique e-mail addresses observed logging into Paypal, were found on Ashley madison lists. It is clear that the QuantumFilament hackers have other sources of e-mails and passwords to try on Paypal, but the Ashley Madison data, with millions of e-mail addresses and passwords, is likely being used. Users who use the same password on Ashley Madison and Paypal, and have not changed their passwords, are particularly at risk.

Original post

I was reading Andrea Peterson’s article on Ashley Madison passwords, which led me to this Ars Technica article with the top 100 passwords used on the Ashley Madison website. That inspired me to look at my data for the approximately 60,282 login attempts to Paypal, the “financial service” discussed here. From the Ars Technica article, the top 20 passwords used on Ashley Madison are:

• 123456
• 12345
• password
• DEFAULT
• 123456789
• qwerty
• 12345678
• abc123
• pussy
• 1234567
• 696969
• ashley
• fuckme
• football
• baseball
• fuckyou
• 111111
• 1234567890
• ashleymadison
• password1

If we marry (pun intended) the Ashley Madison data with the Paypal data, we get some interesting results.

Now let’s examine the rest of the top 20 passwords tried against Paypal accounts by the QuantumFilament hackers (or someone using their network of hacked routers).

The results don’t correlate perfectly, but it does suggest one source for the attempted Paypal logins might be the e-mail addresses and passwords of Ashley Madison users.