A Russian hacker has 272 million stolen Gmail, Yahoo, and Hotmail passwords

...

It may be time to update the password for your email. Usernames and passwords for more than 250 million stolen Yahoo Mail, Gmail, Hotmail, and other accounts are being swapped around in Russia’s criminal underworld, according to Reuters.

These stolen accounts were discovered by Hold Security, where researchers found a Russian hacker, dubbed as “the Collector,” bragging that he was ready to “give away” these credentials, which totaled 1.17 billion records. The security company eliminated duplicates, and found the total number of compromised accounts to be 272.3 million.

Related: Hack into a car in Michigan, spend the rest of your life in prison

The largest amount of compromised credentials, 57 million, belong to Mail.ru users, which is Russia’s most popular email service. The email service has 64 million monthly active users, which means the breach affects most of the company’s userbase.

The rest break down to other popular email clients including Yahoo Mail, which reportedly has 40 million emails compromised; Microsoft Hotmail, with 33 million; and Gmail, with 24 million stolen credentials. Other credentials from email providers in Germany and China are also affected. It’s not clear if any of these accounts have actually been breached.

Many of the emails link to employees of some of the largest U.S. banking, manufacturing, and retail companies. Hold Security has been informing affected companies and organizations.

“This information is potent,” Alex Holden, founder and chief information security officer at Hold Security, told Reuters. “It is floating around in the underground and this person has shown he’s willing to give the data away to people who are nice to him. These credentials can be abused multiple times.”

The Russian hacker allegedly asked for 50 rubles, less than $1, for the data. But the security company received a copy after it agreed to post positive comments about the Russian in various hacker forums. The company didn’t pay for the stolen data, as it went against company policy.

“We are now checking whether any combinations of usernames/passwords match users’ e-mails and are still active,” a Mail.ru spokesperson told Reuters. “As soon as we have enough information, we will warn the users who might have been affected.”

The Russian email provider’s initial checks found no live combinations of user names and passwords that match existing emails.

Google moves quickly to rectify compromised accounts it detects, but cannot speak to specific incidents, according to the search giant. These “credential dumps,” like the one Google discovered in 2014, are an unfortunate reality.

“It’s important to note that in this case and in others, the leaked usernames and passwords were not the result of a breach of Google systems,” the company said in the 2014 blog post. “Often, these credentials are obtained through a combination of other sources. For instance, if you reuse the same username and password across websites, and one of those websites gets hacked, your credentials could be used to log into the others. Or attackers can use malware or phishing schemes to capture login credentials.”

These password dumps are a good reminder to set up a recovery phone number so the Mountain View company can quickly contact users in worst-case scenarios, according to Google.

A Microsoft spokesperson told Reuters that the company has security measures in place to detect compromised accounts, and requires additional information to verify the account owner.

Google told Digital Trends the company did not have a comment on the specific incident at the moment, and Microsoft and Yahoo have yet to respond. We will update this post when we hear back.

Categories
APPLICATIONS
0 Comment

Leave a Reply

Captcha image


RELATED BY

  • 5300c769af79e

    Awesome tech you can’t buy yet: A camera with brains, turbo toothbrush, and more

    It’s a clever smartwatch-inspired action cam that uses machine-learning algorithms to edit and shorten long video sequences.Dollo3D — Self-replicating 3D printer A self-replicating machine that makes other self-replicating machines sounds like the premise of a post-apocalyptic sci-fi thriller flick — but it’s also the concept behind a nifty new Kickstarter campaign.
  • 5300c769af79e

    Tale of Two Launches: OnePlus 3 the Good, Moto Z the Terrible

    To recap, Moto unveiled the Moto Z and Moto Z Force, along with DROID Editions that will launch exclusively on Verizon this summer, before arriving as GSM unlocked phones in the fall.Well, the Moto Z will arrive as an unlocked GSM phone, the Moto Z Force is a Verizon exclusive forever here in the US.
  • 5300c769af79e

    BYOD Doesn't Have to be Your Biggest Headache

    Download 8 Best Practices to Protect Your Enterprise NetworkSmartphones and other personal devices can now be found in most businesses as users are staying connected to the corporate network from anywhere, any time.It's the stuff that keeps IT and security managers up at night - mobile users, multiple devices per user, and enterprise data on the move.
  • 5300c769af79e

    Maintaining Team Focus In The Digital Maelstrom

    For team leaders though, the challenge is to focus on productivity and find ways to be deliberate about harnessing and leveraging technology to make it work for the team, rather than letting it hinder the team's progress.If you've identified that your team's productivity is suffering, now is the time to take action.