Over 770 million email addresses shared online in largest data breach in history

screen shot 2019-01-17 at 11.09.50 am

A security researcher has blown the lid off the largest data breach in history as over 770 million emails and 21 million unique passwords have been exposed, eclipsing the Equifax and Yahoo hacks by a significant margin.

The breach is being dubbed ‘Collection #1’ and contains a raw data set of email addresses and passwords totalling 2,692,818,238 rows from potentially thousands of different sources, according to digital security expert Troy Hunt.

screen shot 2019-01-17 at 11.12.07 am

In terms of sheer volume, it is being considered the largest data breach in history, second only to Yahoo’s high profile cyber security gaffes which affected billions of users, though it is an aggregate of potentially hundreds if not thousands of breaches.

“It just looks like a completely random collection of sites purely to maximize the number of credentials available to hackers,” Hunt told WIRED“There’s no obvious patterns, just maximum exposure.”

screen shot 2019-01-17 at 11.14.24 am

The breach contains previously encrypted passwords that have been “dehashed” or cracked and converted back to plain text and includes files allegedly from as early as 2008. The information wasn’t even for sale but was merely dumped on MEGA and subsequently on a popular hacking forum, free for anyone with scroll and click capabilities to review.  

screen shot 2019-01-17 at 11.15.30 am

As a result, there is a greatly increased risk of so-called credential-stuffing attacks in which hackers spam websites with various combinations of emails and passwords, including – but not limited to – services like Netflix, Facebook or other social media accounts, and online services. The breach doesn’t appear to contain social security or credit card data.

screen shot 2019-01-17 at 11.16.40 am

Hunt recommends checking your email addresses on the free service provided by Have I Been Pwned.

If you are included in the breach, which is extremely likely, he recommends using a password manager or even going old school and employing *gasp* a pen and paper to store your passwords offline. Hack that!

screen shot 2019-01-17 at 11.18.21 am

“It might be contrary to traditional thinking, but writing unique passwords down in a book and keeping them inside your physically locked house is a damn sight better than reusing the same one all over the web,” Hunt wrote in his blog post on the breach.

A lucky few are claiming to have escaped the breach, but the odds are not in your favor.

Blog at WordPress.com.

Up ↑