Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/17/2019
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

773 Million Email Addresses, 21 Million Passwords For Sale on Hacker Forum

Data appears to be from multiple breaches over past few years, says researcher who discovered it.

A folder with over 12,000 files containing nearly 773 million email addresses and over 21 million unique passwords from numerous previous data breaches — some potentially dating back to 2008 — has been posted online in another massive leak of credential data.

Security researcher Troy Hunt discovered the 87 GB worth of data on cloud storage service Mega last week and has uploaded it to his Have I Been Pwned (HIBP) service, where individuals can verify if their email addresses are on the list. The leaked passwords, meanwhile, have been published on Pwned Passwords, a site that Hunt maintains to let people check whether their passwords have been exposed in data breaches.  

Some 140 million email addresses and about half of the just-leaked passwords are new, meaning the data has not been previously published on HIBP or the compromised passwords site. With the new data, Pwned Passwords now contains more than half-a-billion leaked passwords.

In a blog Thursday, Hunt described the folder he discovered on Mega as containing data from what appears to be over 2,000 previously breached and dehashed databases. The data appears to be from breaches between 2008 and 2015. But it is possible that at least some of leaked data was not involved in a data breach at all, Hunt said.

It's unclear who might have compiled the list of breached databases and put them in the file that was leaked on Mega. Attackers commonly use such datasets to carry out automated "credential stuffing" attacks where they try breaking into enterprise accounts using combinations of previously compromised email and password data.

The file on Mega has since been removed. But, according to Hunt, the data is currently being advertised for sale in a popular hacker forum. Hunt is calling the breach "Collection #1" after the name given to the root folder containing the files.

The Collection #1 breach is among the biggest involving passwords and email addresses. Other similarly massive compromises include one recently at Marriott International, in which 380 million records were exposed; multiple breaches at Yahoo, which ended up exposing all 3 billion of its user accounts; and one at Adult Friend Finder, which impacted 412 million accounts.

Such breaches keep highlighting the weakness of password-only account protection models and the need for strong authentication mechanisms. A new report from MarketsandMarkets shows concerns over data breaches and regulations are driving demand for multifactor authentication technologies. The market for such tools and services is projected to grow by over 15.5% annually over the next few years to top $12 billion by 2022, according to the analyst firm.

Bimal Gandhi, CEO at Uniken, says credential leaks pose a multifaceted threat for organizations. The fact that people often reuse passwords across personal and office accounts exposes organizations to attack even if their own sites and user credentials haven't been compromised.

"An attacker can replay your customers’ known credentials from other sites against you on the reasonable chance that those credentials will also allow them access to your applications," Gandhi says. Attackers have a broad array of methods to attack organizations via both the mobile and the browser using harvested credentials, he says.

Credential data is also invaluable for phishing, says Tim Erlin, vice president of product management and strategy at Tripwire. There has been a recent increase in the use of compromised credentials in email extortion attempts, he says.

The fact that at least some of the leaked credential data is old makes it relatively less of a threat to organizations that regularly change passwords. But the potential for misuse should not be underestimated, Erlin says. "People often change personal passwords far less frequently than corporate credentials, meaning that there may very well be valid data present," he added.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
reuben_matthews
50%
50%
reuben_matthews,
User Rank: Apprentice
2/6/2019 | 10:24:47 PM
Download the collections
Download HIBP Collections #1 and #2 - 5: https://tinyurl.com/y9o3d2ug
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/18/2019 | 6:44:09 AM
Selected note
One comment - any self-respecting computer user who has kept the same password(s) since 2008 (now 11 years ago) almost deserves to be hacked. 
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18056
PUBLISHED: 2019-08-20
An issue was discovered in the Texas Instruments (TI) TM4C microcontroller series, such as the TM4C123. The eXecute-Only-Memory (XOM) implementation prevents code read-outs on protected memory by generating bus faults. However, single-stepping and using breakpoints is allowed in XOM-protected flash ...
CVE-2017-18566
PUBLISHED: 2019-08-20
The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
CVE-2018-20978
PUBLISHED: 2019-08-20
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
CVE-2017-18526
PUBLISHED: 2019-08-20
The moreads-se plugin before 1.4.7 for WordPress has XSS.
CVE-2017-18527
PUBLISHED: 2019-08-20
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.