1bn email addresses, passwords breached, posted online
The largest ever collection of breached data ever has been discovered and it exposes more than one billion unique combinations of email addresses and passwords. A security researcher found the 87GB dump of data hidden on a hacker forum and says many of them have been previously included in other leaks such as the infamous […]
The largest ever collection of breached data ever has been discovered and it exposes more than one billion unique combinations of email addresses and passwords.
A security researcher found the 87GB dump of data hidden on a hacker forum and says many of them have been previously included in other leaks such as the infamous MySpace and LinkedIn breaches.
Troy Hunt, who runs the ‘Have I Been Pwned’ breach-notification service, found the leak on cloud-service MEGA and called it ‘Collection #1’, Daily Mail reported.
He said: ‘If you’re in this breach, one or more passwords you’ve previously used are floating around for others to see.’
Users from around the world are believed to be affected.
People are encouraged to use password managers, avoid using the same password for several accounts and not to use predictable passwords to lower their exposure.
An alleged dossier of more than 2,000 websites was also exposed which, it is claimed, is the source of some of the data.
These include: belgium.trans-escorts.com, www.themusichutch.com and botanyconference.org.
A Bitcoin site called bitcointalk.org allegedly is responsible for more than half a million user leaks.
It remains unknown if all the information came from one or several sources.
What is credential stuffing and how does it put your online accounts at risk?
Hackers can obtain breached credentials, like usernames and passwords, on the Dark Web – often for free.
Most people reuse the same credentials for multiple accounts they hold online, which means that once one account is breached, others may be vulnerable.
Cyber criminals can use software tools to test combinations of credentials in a highly automated bulk effort.
The best defence against this type of attack is to use a unique password for each site you have an account with.
There are various password management applications that can help you to keep track of all of these details in a secure manner.
They are often easily avoidable by installing a password manager.
Robin Tombs, CEO and Co-Founder of identity firm Yoti, said: ‘This latest news of 770 million email addresses and passwords being exposed on a hacking forum shows just how flawed passwords are for protecting our online accounts.
‘They can use an email address and password obtained from a breach to access an individual’s accounts and valuable personal information.
‘With the development of password managers, help is at hand. They can securely store your login details – eliminating the need to remember all of your passwords.
‘Crucially they can be secured with your unique biometrics rather than a master password – meaning only you can access and use your passwords.’
Here are some steps to follow when creating a new password:
DO:
- Use a combination of numbers, symbols, uppercase and lowercase letters
- Ensure that the password is at least eight characters long
- Use abbreviated phrases for passwords
- Change your passwords regularly
- Log out of websites and devices after you have finished using them
DO NOT:
- Choose a commonly used password like ‘123456’, ‘password’, ‘qwerty’ or ‘111111’
- Use a solitary word. Hackers can use dictionary-based systems to crack passwords
- Use a derivative of your name, family member’s name, pet’s name, phone number, address or birthday
- Write your password down, share it or let anyone else use your login details
- Answer ‘yes’ when asked to save your password to a computer browser.