Thursday, March 28, 2024

773 Million Credentials of Email & Password leaked in Massive Data Breach – Biggest Data Dump Ever Found on a Decade

Welcome to the Massive Data breach of 2019, around 773 million datas contains email addresses and passwords were breached and circulated in hacker forums. This data breach seems to be bigger and critical than earlier breaches like “Equifax” and “Marriott International“.

Let’s have a look into This Massive Data Breach

The data set was first reported by security researcher Troy Hunt, who maintains Have I Been Pwned, a way to search whether your own email address or password has been compromised by a breach at any point. Many of us know about the famous “HIBP” site, where users can check whether their email address or the unique password is “pwned” somewhere.

Let’s assume, that I’m using “[email protected]” and a “Password12$”. Since we are accessing various sites using this same email address and same password for it for better convenicence.

To measure the criticality of this, Years ago Troy the security practitioner created a site “haveibeenpwned” to validate whether the email address has been used somewhere else or by someone else and also recently he has created a feature to also check uniqueness for validating the passwords. Over the years, many user/organizations/institutions were using this site and checking the credentials uniqueness.

Exactly what was happens?

MEGA cloud storage service, recently seen some folder named as “Collection#1“, this folder have some 12K files and merely 87GB of data. Some of the links directly pointing out to popular hacker forums mid-December.

This Massive Data Breach contained a data, dubbed names as Collection #1“, is a set of email addresses and passwords totaling 2,692,818,238 rows that have allegedly come from many different sources.

This Massive Data Breach leads to the expose of email addresses and passwords which has been harvested from various other sources of different breaches of different timeframes were kept in a folder.

So Totally 772,904,991 The unique email addresses and 21,222,975 unique passwords exposed which is now loaded into Have I Been Pwned (HIBP)

Risk Factor

The unique email addresses and the passwords, can be used by the hackers for the credential stuffing.

“Credential Stuffing – It is the automated process of breached username/passwords pair in trying combo to gain unauthorized access of user accounts through large-scale automated login requests.”

There are possibilities, of hackers can leverage the help of using various software to invoke the credential stuffing. Also, there are some possibilities where they can sell the data’s in DarkNet to the highest bidder, who can use it for APT attacks. “Attribution of this breach still unknown“.

Current Solutions

1.) Never reuse the same password for all the apps/sites.
2.) Increase the strength of the password by adding more mixe characters.
3.) Get a password manager.
4.) Enable 2-Factor-Authentication on social media platforms

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles