Mother of all data breaches sees 1.3 BILLION passwords exposed… check if yours is compromised
A massive collection of 1.3 billion passwords alongside nearly two billion email addresses has been exposed online.
Have I Been Pwned (HIBP), an online service that notifies people if they were exposed in a data breach, processed the data compiled from multiple sources where cybercriminals had published stolen credentials.
HIBP CEO Troy Hunt, who admitted his password made the list, said: 'This corpus is nearly three times the size of the previous largest breach we [have ever] loaded.'
The dataset includes 1,957,476,021 unique email addresses and 1.3 billion unique passwords, 625 million never been seen before by HIBP.
With more than 5.5 billion people worldwide using the internet, researchers warned that everyone should change their passwords as a precaution.
The records combined past breaches with credential-stuffing lists, a type of data used by attackers to try stolen passwords across multiple accounts.
HIBP verified the dataset by checking actual users' credentials. Many passwords were old or unused, but others were still actively protecting accounts, illustrating the real-world risk.
Hunt offered HIBP to help users determine if their credentials were compromised, allowing them to check email addresses and passwords for instant results.
HIBP's Pwned Passwords service allows anyone to check if a password has been previously exposed without revealing which email addresses it was linked to, preserving privacy while improving security.
'I hate hyperbolic news headlines about data breaches, but for the '2 Billion Email Addresses' headline to be hyperbolic, it'd need to be exaggerated or overstated - and it isn't,' Hunt said.
'It's the most extensive corpus of data we've ever processed, by a margin.
Cybersecurity experts are urging immediate action, telling individuals to use a secure password manager and create unique, strong passwords for each account.
Two-factor authentication should be enabled on all accounts, with priority given to email and administrative logins.
Organizations are advised to run credential checks to identify reused or exposed passwords among users.
Breached-password detection should be implemented during logins and password changes. Access privileges should be audited, service accounts restricted, and outdated credentials removed.
For individuals, the key takeaway of the data breach is clear: passwords alone are no longer enough.
https://www.dailymail.co.uk/sciencetech/article-15299857/data-breaches-passwords-exposed.html