Sunday, May 19, 2024

773 Million Credentials of Email & Password leaked in Massive Data Breach – Biggest Data Dump Ever Found on a Decade

Welcome to the Massive Data breach of 2019, around 773 million datas contains email addresses and passwords were breached and circulated in hacker forums. This data breach seems to be bigger and critical than earlier breaches like “Equifax” and “Marriott International“.

Let’s have a look into This Massive Data Breach

The data set was first reported by security researcher Troy Hunt, who maintains Have I Been Pwned, a way to search whether your own email address or password has been compromised by a breach at any point. Many of us know about the famous “HIBP” site, where users can check whether their email address or the unique password is “pwned” somewhere.

Let’s assume, that I’m using “[email protected]” and a “Password12$”. Since we are accessing various sites using this same email address and same password for it for better convenicence.

To measure the criticality of this, Years ago Troy the security practitioner created a site “haveibeenpwned” to validate whether the email address has been used somewhere else or by someone else and also recently he has created a feature to also check uniqueness for validating the passwords. Over the years, many user/organizations/institutions were using this site and checking the credentials uniqueness.

Exactly what was happens?

MEGA cloud storage service, recently seen some folder named as “Collection#1“, this folder have some 12K files and merely 87GB of data. Some of the links directly pointing out to popular hacker forums mid-December.

This Massive Data Breach contained a data, dubbed names as Collection #1“, is a set of email addresses and passwords totaling 2,692,818,238 rows that have allegedly come from many different sources.

This Massive Data Breach leads to the expose of email addresses and passwords which has been harvested from various other sources of different breaches of different timeframes were kept in a folder.

So Totally 772,904,991 The unique email addresses and 21,222,975 unique passwords exposed which is now loaded into Have I Been Pwned (HIBP)

Risk Factor

The unique email addresses and the passwords, can be used by the hackers for the credential stuffing.

“Credential Stuffing – It is the automated process of breached username/passwords pair in trying combo to gain unauthorized access of user accounts through large-scale automated login requests.”

There are possibilities, of hackers can leverage the help of using various software to invoke the credential stuffing. Also, there are some possibilities where they can sell the data’s in DarkNet to the highest bidder, who can use it for APT attacks. “Attribution of this breach still unknown“.

Current Solutions

1.) Never reuse the same password for all the apps/sites.
2.) Increase the strength of the password by adding more mixe characters.
3.) Get a password manager.
4.) Enable 2-Factor-Authentication on social media platforms

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.


Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles