Over the last five years more than 13.5 billion records of personally identifiable information (PII) have been lost or stolen in hacks of data centers worldwide, including those from the recent theft at Marriott. Most are or were available for sale on the dark web. Buyers of that stolen data use it to attack financial institution and retailer web, mobile, and API applications to see if consumers used the same username and password credentials at multiple locations. With credentials and other PII, criminals commit account takeover, content scraping, money laundering, prepaid card purchases, dis...