Russian Hackers Are Hoarding More Than a Billion Stolen Passwords

A Russian crime gang is in possession the largest known collection of stolen passwords, user names, email addresses, and other online credentials. That's one of the worst collections a Russian crime gang can have other than, I don't know, rocket launchers and dirty bombs.

Milwaukee-based security research firm Hold Security says that the Russian hacking ring holds over 1.2 billion user name and password combinations and 500 million email addresses. They reportedly used a series of botnets to trawl the web, eventually collecting over 4.5 billion records (though many overlapped, so there were 1.2 unique combinations).

The New York Times consulted other experts for more information; what they found is scary:

At the request of The New York Times, a security expert not affiliated with Hold Security analyzed the database of stolen credentials and confirmed it was authentic. Another computer crime expert who had reviewed the data, but was not allowed to discuss it publicly, said some big companies were aware that their records were among the stolen information.

But just because companies are aware doesn't mean they've fixed the problem and your information is safe:

"Hackers did not just target U.S. companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites," said Alex Holden, the founder and chief information security officer of Hold Security. "And most of these sites are still vulnerable."

So what can you do? Change up your passwords and usernames, or at least your passwords. It appears the crime gang, which is based in south central Russia and is thought to be run by men in their 20s, has not sold the information. Instead, Hold Security believes they're using it to spam people on Twitter.

Hackers are continuing to outpace the digital security precautions of so many companies and organizations that it's starting to feel like a losing battle. Hold Security is working to develop a tool people can use to check if some grubby Russian Millennial has a copy of their information, but until then, there aren't many practical steps people can take besides changing their information regularly. [New York Times]

Image by lolloj/Shutterstock.