A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say.
The records, discovered by Hold Security, a firm in Milwaukee, include confidential material gathered from 420,000 websites, including household names, and small Internet sites.
At the request of The New York Times, a security expert not affiliated with Hold Security analysed the database of stolen credentials and confirmed it was authentic.
“Hackers did not just target US companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites,” said Alex Holden, the founder and chief information security officer of Hold Security. “And most of these sites are still vulnerable.”
There is worry among some in the security community that keeping personal information out of the hands of thieves is increasingly a losing battle.
- Soon You Could Get Plastic Currency Notes: Find Out More
- Ranveer Singh and Vaani Kapoor Starrer Befikre Gets A Thumbs Up
- Supreme Court Seeks Centre’s Response Over Various Issues Regarding Demonetisation
- Defence Minister Manohar Parrikar Writes To West Bengal CM Mamata Banerjee
- Bigg Boss 10 December 8 Review: Swami Om Feels Cheated, lashes Out At Gaurav For Jail Punishment
- South Korean President Park Geun-Hye Impeached Over Corruption Scandal
- Former Air Chief SP Tyagi Arrested In VVIP Chopper Scam
- After Congress Vice President Rahul Gandhi, Liquor Baron Vijay Mallya’s Twitter Account Hacked
- Find Out What PM Narendra Modi Told Cabinet Over Demonetisation Decision
- Home Minister Rajnath Singh Assures Safety Of All Tourists Stranded On Havelock Island
- Government To Waive Service Tax On Debit, Credit Card Transactions Of Up To Rs 2,000
- President Pranab Mukherjee Criticises Parliament Disruptions Over Demonetisation
- Pakistan International Airlines Flight Carrying Over 40 Passenger On Board Crashes
- Shah Rukh Khan On Raees Clash With Kaabil: It’s Impossible To Have A Solo Release In India
- US-President Elect Donald Trump Named TIME’s Person Of The Year 2016
In December, 40 million credit card numbers and 70 million addresses, phone numbers and additional pieces of personal information were stolen from the retail giant Target by hackers in Eastern Europe.
But the discovery by Hold Security dwarfs those incidents, and the size of the latest discovery has prompted security experts to call for improved identity protection on the web.
Websites inside Russia had been hacked, too, and Holden said he saw no connection between the hackers and the Russian government. He said he planned to alert law enforcement after making the research public, though the Russian government has not historically pursued accused hackers.
So far, the criminals have not sold many of the records online. Instead, they appear to be using the stolen information to send spam on social networks like Twitter at the behest of other groups, collecting fees for their work. But selling more of the records on the black market would be lucrative.
While a credit card can be easily canceled, personal credentials like an email address, Social Security number or password can be used for identity theft. Because people tend to use the same passwords for different sites, criminals test stolen credentials on websites where valuable information can be gleaned, like those of banks and brokerage firms.
The hacking ring is based in a small city in south central Russia, the region flanked by Kazakhstan and Mongolia. The group includes fewer than a dozen men in their 20s who know one another personally — not just virtually.
“There is a division of labour within the gang,” Holden said. “Some are writing the programming, some are stealing the data. It’s like you would imagine a small company; everyone is trying to make a living.”