Tuesday, June 25, 2024

361 Million Unique Email Credentials Leaked On Telegram Channels

Over 122GB of data was scraped from thousands of Telegram channels, containing 1.7k files with 2B lines and 361M unique email addresses, of which 151M had never been seen in Have I Been Pwned (HIBP) before.

Alongside those addresses were passwords and, in many cases, the website the data pertains to.

I loaded it into HIBP today because there are many previously unseen email addresses, and based on all the checks I’ve done, it’s legitimate data, TroyHunt said.

That’s the high-level overview. Here are the details.

Telegram: A Breeding Ground for Data Breaches

Telegram is a popular messaging platform that makes it easy to set up a “channel” and share information with those who wish to visit it.

As Telegram describes the service, it’s simple, private, and secure.

As such, it has become very popular with those wishing to share content anonymously, including content related to data breaches.

Many of the breaches I’ve previously loaded into HIBP have been distributed via Telegram as it’s simple to publish this class of data to the platform.

According to Troy Hunt’s blog, the data posted to Telegram often appears as “combolists,” which are combinations of email addresses or usernames and passwords.

These combinations are used to authenticate to various services, and attackers often use these lists to mount “credential stuffing” attacks, where they attempt to access accounts en masse.

The list above is simply breaking the combos into their respective email service providers.

The Scale of the Breach

The data sent to me last week was sourced from 518 different channels and amounted to 1,748 separate files similar to the one above.

With ANYRUN You can Analyze any URL, Files & Email for Malicious Activity : Start your Analysis

Some of the files have no data (0kb), while others are many gigabytes with many tens of millions of rows. For example, the largest file starts like this:

largest file starts
largest file starts

This looks very much like the result of info stealer malware that has obtained credentials as they were entered into websites on compromised machines.

For example, the first record appears to have been snared when someone attempted to log in to Nike.

first record appears to have been snared when someone attempted to log in to Nike.
first record appears to have been snared when someone attempted to log in to Nike.

Verifying the Data

To get a sense of the accuracy of this data, HIBP tested several email addresses on various websites.

email addresses on various websites.
email addresses on various websites.

For instance, entering an email address from the stealer log on the Nike homepage confirmed that the address had an account.

Similarly, other services like Footlocker and an Italian tire retailer confirmed the existence of the tested accounts.

 existence of the tested accounts.
existence of the tested accounts.

Subscriber Feedback

Existing HIBP subscribers are contacted to verify the legitimacy of the data.

They are able to confirm the accuracy of the details but noted they were leaked in previous data breaches.

Another subscriber, in 7 prior breaches, found the credentials familiar, likely reused from previous breaches.

One fascinating case involved a subscriber’s daughter with an Epic Games account.

The credentials matched her old account, confirming the legitimacy of the data.

To understand the impact of the unseen addresses, I contacted HIBP subscribers who had never appeared in a breach before.

This ruled out repurposed prior incidents and provided a clearer picture of the data’s significance.

The responses confirmed the legitimacy and uniqueness of the data, highlighting the breach’s extensive reach.

The leak of 361 million unique email credentials on Telegram channels is a significant data breach, with 151 million previously unseen addresses now loaded into HIBP.

This incident underscores the importance of robust cybersecurity measures and the need for users to remain vigilant about their online credentials.

Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo 

Website

Latest articles

Hackers Attacking Windows IIS Server to Upload Web Shells

Windows IIS Servers often host critical web applications and services that provide a gateway...

WikiLeaks Founder Julian Assange Released in Stunning Deal with U.S.

WikiLeaks founder Julian Assange has been released from prison after reaching a deal with...

Four Members of FIN9 Hackers Charged for Attacking U.S. Companies

Four Vietnamese nationals have been charged for their involvement in a series of computer...

BREAKING: NHS England’s Synnovis Hit by Massive Cyber Attack

In a shocking development, the NHS has revealed that it was the victim of...

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Microsoft Power BI Vulnerability Let Attackers Access Organizations Sensitive Data

A vulnerability in Microsoft Power BI allows unauthorized users to access sensitive data underlying...
Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles