Hacker Lifts Millions of User Credentials from Webmail Providers: Report
A hacker recently attempted to sell hundreds of millions of stolen records to Hold Security for less than one US dollar, the information security firm said on Wednesday.
The “kid from a small town in Russia” has collected 272 million unique stolen credentials, according to Hold Security, and even more disturbing, the company has never seen 42.5 million of them before, meaning they may be from previously unreported breaches.
While most of the data Hold Security initially recovered from the hacker was unattributed data which had been passed around the Dark Web, some was originally stolen from a major Eastern European communications company, and medium-sized online service providers.
SEE ALSO: Organizations Feel More Confident in their Security Than a Year Ago: Report
When the full data set was recovered, Hold found millions of credentials from Mail.ru, Google, Yahoo, and Microsoft email accounts. All four companies told the BBC they were aware of the stolen credentials, and Mail.ru said that its investigation has initially suggested that the credentials may not still be active.
Email address and password combinations that have gone stale can still be useful to cybercriminals, however, for instance in targeted phishing attacks.
“This information is potent. It is floating around in the underground and this person has shown he’s willing to give the data away to people who are nice to him,” Hold Security founder and chief information security officer Alex Holden told Reuters. “These credentials can be abused multiple times.”
Hold Security has an established track record of uncovering breaches, including the theft of 1.2 billion credentials by the “Cybervor” gang in 2014.
Hold Security came into contact with the hacker as part of its regular interaction with the cybercriminal underworld, which supplements its automated information harvesting. The hacker claimed to have 900 million credentials in one batch, and after a protracted period of negotiation and refusing to pay the 50-rouble asking price, Hold managed to exchange “likes/votes to his social media page” in return for a compressed database containing a total of 1.17 billion stolen credentials from various breaches.
Source: TheWHIR