Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/17/2019
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

773 Million Email Addresses, 21 Million Passwords For Sale on Hacker Forum

Data appears to be from multiple breaches over past few years, says researcher who discovered it.

A folder with over 12,000 files containing nearly 773 million email addresses and over 21 million unique passwords from numerous previous data breaches — some potentially dating back to 2008 — has been posted online in another massive leak of credential data.

Security researcher Troy Hunt discovered the 87 GB worth of data on cloud storage service Mega last week and has uploaded it to his Have I Been Pwned (HIBP) service, where individuals can verify if their email addresses are on the list. The leaked passwords, meanwhile, have been published on Pwned Passwords, a site that Hunt maintains to let people check whether their passwords have been exposed in data breaches.  

Some 140 million email addresses and about half of the just-leaked passwords are new, meaning the data has not been previously published on HIBP or the compromised passwords site. With the new data, Pwned Passwords now contains more than half-a-billion leaked passwords.

In a blog Thursday, Hunt described the folder he discovered on Mega as containing data from what appears to be over 2,000 previously breached and dehashed databases. The data appears to be from breaches between 2008 and 2015. But it is possible that at least some of leaked data was not involved in a data breach at all, Hunt said.

It's unclear who might have compiled the list of breached databases and put them in the file that was leaked on Mega. Attackers commonly use such datasets to carry out automated "credential stuffing" attacks where they try breaking into enterprise accounts using combinations of previously compromised email and password data.

The file on Mega has since been removed. But, according to Hunt, the data is currently being advertised for sale in a popular hacker forum. Hunt is calling the breach "Collection #1" after the name given to the root folder containing the files.

The Collection #1 breach is among the biggest involving passwords and email addresses. Other similarly massive compromises include one recently at Marriott International, in which 380 million records were exposed; multiple breaches at Yahoo, which ended up exposing all 3 billion of its user accounts; and one at Adult Friend Finder, which impacted 412 million accounts.

Such breaches keep highlighting the weakness of password-only account protection models and the need for strong authentication mechanisms. A new report from MarketsandMarkets shows concerns over data breaches and regulations are driving demand for multifactor authentication technologies. The market for such tools and services is projected to grow by over 15.5% annually over the next few years to top $12 billion by 2022, according to the analyst firm.

Bimal Gandhi, CEO at Uniken, says credential leaks pose a multifaceted threat for organizations. The fact that people often reuse passwords across personal and office accounts exposes organizations to attack even if their own sites and user credentials haven't been compromised.

"An attacker can replay your customers’ known credentials from other sites against you on the reasonable chance that those credentials will also allow them access to your applications," Gandhi says. Attackers have a broad array of methods to attack organizations via both the mobile and the browser using harvested credentials, he says.

Credential data is also invaluable for phishing, says Tim Erlin, vice president of product management and strategy at Tripwire. There has been a recent increase in the use of compromised credentials in email extortion attempts, he says.

The fact that at least some of the leaked credential data is old makes it relatively less of a threat to organizations that regularly change passwords. But the potential for misuse should not be underestimated, Erlin says. "People often change personal passwords far less frequently than corporate credentials, meaning that there may very well be valid data present," he added.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
reuben_matthews
50%
50%
reuben_matthews,
User Rank: Apprentice
2/6/2019 | 10:24:47 PM
Download the collections
Download HIBP Collections #1 and #2 - 5: https://tinyurl.com/y9o3d2ug
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/18/2019 | 6:44:09 AM
Selected note
One comment - any self-respecting computer user who has kept the same password(s) since 2008 (now 11 years ago) almost deserves to be hacked. 
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31664
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-33185
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
CVE-2021-33186
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-31272
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.
CVE-2021-31660
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information.