71% of US Adults Have Dangerous Online Security Habits This Year, CNET Survey Finds

If you’re like me, then your sensitive data has been compromised in a data breach – probably more than once.

An exclusive CNET poll found that 47% of US adults know personal data was leaked in a cyber attackwith Gen X and Baby Boomers reporting higher levels of sensitive data leakage. About half of millennials surveyed said they have also been affected by a data breach, while one in four Gen Z respondents say their data has been compromised.

Data breaches occur almost every day for many reasons, including phishing attacks by malicious actors, human error, and even employees looking to profit from company data.

The good news is that a data breach does not directly lead to identity theft or fraud. However, it puts you at greater risk of phishing attempts on your personal devices. So it’s up to us to keep our data and identity safe.

CNET’s cybersecurity survey reveals trends in how people reacted after learning about them participation in a data breachwhat Fraud worries them the most and how they protect their identities online, especially during the busy shopping season.

Key things

• 84% of respondents use some method of protecting their personal data during these holidays.
• However, 71% of US adults have already taken steps to protect their personal information in the past year that security experts consider unsafe.
• CNET found that 41% of US adults surveyed used the same password on multiple accounts in the past 12 months. Perhaps more worryingly, one in five adults have also opted out of two-factor authentication in the past year.
• One in five US adults is unsure if their data has been compromised by a cyber attack.

Most people change their passwords after a data breach

The first steps you take after learning that you have been affected by a data breach are critical. Most adults, 68% to be exact, have have changed their password after learning of a cyber attack, while another 41% enrolled in two-factor authentication across multiple online accounts.

Other popular responses to having your information exposed in a data breach include placing a fraud alert on your credit report (35%) and logging into identity theft protection (33%).

When a company detects a data breach, it often sends out email notifications to potentially affected customers that include free activation codes to protect against identity theft. Coverage typically lasts one or two years—depending on the severity of the breach and what personal data was compromised. However, after the offer expires, you can register yourself for identity theft protection.

Protect your personal information and gain peace of mind with CNET’s best identity theft software.

One of the best ways to protect yourself after a data breach was a no-step for most respondents. Only 27% of US adults reported having their credit frozen after a breach. Credit freezes are free to the public and a great way to prevent identity fraud, experts say. I froze my credit in April and found it to be a simple process.

“Never wait to be notified of a data breach to freeze your credit,” said Adam Levin, author and co-host of the What the Hack podcast with Adam Levin. “If your credit is frozen, no one can access your credit files. This means that it is impossible for anyone – including you – to open a new credit account until your file is unfrozen.”

Notably, 20% of adults stopped using a company’s services altogether after being affected by a data breach.

Most Americans have bad password habits

While data breaches are out of the customer’s control, how you protect your data online is something you can manage. It all starts with strong password hygiene.

CNET found that 41% of US adults surveyed have used the same password on multiple accounts in the past year. This is a practice you are prone to credential filler by cybercriminals – gaining access to one account and testing the same credentials elsewhere.

For this reason, experts recommend using a unique password for each of your online accounts. If that sounds too difficult, a password manager can help.

“With a password manager, you don’t have to remember any of your passwords because the software stores them all in a secure vault and can autofill them when you sign in to your accounts,” said Attila Tomaschek, CNET staff writer and digital privacy expert.

A password manager can monitor the dark web for compromised credentials and alert you to data breaches so you can update your passwords if they’re exposed, he added.

Perhaps more worryingly, one in five adults have also opted out of two-factor authentication in the past year. Many financial institutions and retailers will periodically send push notifications or text codes to your phone to verify your identity or if you’ve logged into your account from a new device. This extra layer of security can help prevent cybercriminals and alert you if someone tries access your account.

“It might seem a bit inconvenient and add a few extra seconds to the sign-in process, but it’s worth it,” said Neal O’Farrell, a cybersecurity expert. Member of CNET’s expert council.

Cyber ​​security is a top topic for shoppers this holiday season

The holidays bring a lot of joy, but also an increased risk of running into a scam that can spoil your happy mood.

A total of 84% of people surveyed said they are taking some form of extra security when buying gifts this year. While some shoppers will only shop in person, nearly half of adults (48%) said they will only shop on reputable websites. Many (43%) also choose to shop directly from mobile apps such as Amazon, Walmart, Target and Etsy to avoid being lured to fake websites.

Thirty-seven percent of holiday shoppers will also strengthen password hygiene by taking steps such as enabling two-factor authentication on new accounts or using unique passwords, a password manager or passkey.

Fewer said they would check if a website has “https” encryption (31%) or use a digital wallet Apple Pay or Google Wallet and Samsung Wallet (24%). Digital wallets use tokenizationwhich, in layman’s terms, prohibits the merchant from viewing or storing your actual card information. If this merchant is hacked in the future, your card information will remain safe.

Non-delivery scams worry shoppers the most

66% of Americans are worried about the rising trend of fraud become a victim of fraud this holiday season and beyond.

About one quarter of the respondents are most afraid of fraud with the non-delivery of packages. These scams involve scammers sending an email or text that looks like it’s from UPS or FedEx, that contains a fake purchase notification or claims there’s a delivery problem. The intention is simply to steal your personal or financial information after clicking on the provided link.

“The best thing to remember is to simply skip the links and certainly any attachments in these messages,” said Bree Fowler, senior writer for cybersecurity and digital privacy at CNET. “Instead, go directly to the shipper’s website (UPS, USPS, FedEx.) and enter your attachment information. If the message appears to be from a retailer you do business with, go directly to their app or website.”

Parcel scams are always big and more people at this time of year online shopping for the holidays. Shoppers spent a total of $13.3 billion this year on Cyber ​​Monday alone, up 7.3% year over year, according to Adobe.

Additionally, one in five Americans worry about being scammed by customer support scams, where a fraudster pretends to work at a legitimate institution and convinces you to share your account information. Other common scams that people fear falling for include charity scams, gift cards draining fraud a romantic scams.

Also, with tax season right around the corner, you should file your taxes early to avoid tax return fraud and beware of getting scammed by a scammer claiming you owe money to the IRS.

If you ever receive an unsolicited call or message, hang up and call the company or federal agency directly using the number on their official website to confirm the validity of the communication.

“Never verify yourself to anyone who contacts you, even if you think they are someone in authority at a government agency or organization you have a relationship with,” Levin said.

Scammers often trap you by creating a false sense of urgency in their requests. Don’t fall for this. Instead, take the time to think about what’s going on so you don’t accidentally make it easier for a scammer to get your sensitive data or money.

“Crime is like any business, and criminals only have so much time to devote to a particular target before they find it unprofitable,” O’Farrell told CNET. “The harder you make it for them and the more you thwart their attempts, the faster they move on.”

Methodology

CNET commissioned YouGov Plc to conduct the survey. All data, unless otherwise stated, is from YouGov Plc. The total sample size was 2,518 adults. Fieldwork was conducted between November 4 and 7, 2024. The survey was conducted online. Data have been weighted and are representative of all US adults (age 18 and older).