An all-time biggest ever data leak has endangered billions of internet accounts, prompting cybersecurity experts to sound an urgent alarm to safeguard digital identities.
The discovery, which was found by cyber researcher Bob Diachenko and Cybernews, comprised 30 separate datasets that amounted to in excess of 16 billion login credentials. The records, which resided on insecure Internet servers for an unknown amount of time, were subsequently taken down.
While not one particular platform such as Facebook, Google, or Apple was hacked directly, many of the leaked login credentials belonged to them. That’s primarily due to infostealer malware — malware designed to steal login credentials, cookies, and session data from compromised systems — being utilized.
As per experts, much of this data was aggregated from infostealers, while part thereof originated from previous breaches and credential-stuffing attacks. In all cases, data had well-formed structure comprised of login URLs, usernames, and passwords — easy for attackers to specifically target websites.
Information security professionals emphasize good password hygiene after this leak. Most crucial among them is having a password manager to create and store one’s unique passwords, enabling two-factor authentication (2FA) for all valuable accounts, and checking every once in a while for compromise using websites like haveibeenpwned.com.
While much of this leaked data may already be in circulation among cybercrime communities, due to its sheer magnitude and integration, it is extremely dangerous. Some of these datasets had browser cookies and session tokens that may be in a position to bypass even 2FA processes in specific systems.
This attack signifies a general shift in cybercrime methodologies, in which more and more are relying on infostealers and large aggregated credential dumps instead of directly targeting corporations. Now, billions of stolen credentials are in circulation, and users and orgs are encouraged to secure systems in a proactive manner.
What you can do today—in other words, run scanning programs to detect malware, reset all recycled or insecure passwords, and enable 2FA—can significantly reduce account compromise.