A vast database containing 42 million records of email addresses, passwords in plain text and partial credit data was discovered on a free hosting service Kayo.moe.
HaveIBeenPwned.com is an online platform run by security researcher Troy Hunt which can be used by the user to check whether their personal data has been compromised or not.
According to the analysis by Hunt, the records in the database were collected for credential stuffing attacks.
The hackers collect data from different breaches and combine it into a single list and run them automatically against various online services to compromise user accounts.
When the researcher analysed a sample set, he discovered 89% of them were already in HIBP archives, and this means there is a massive amount of data which were not there in HIBP archives.
“When I pulled the email addresses out of the file, I found almost 42M unique values. I took a sample set and found about 89% of them were already in HIBP which meant there was a significant amount of data I’ve never seen before. (Later, after loading the entire data set, that figure went up to 93%.)”
“There was no single pattern for the breaches they appeared in and the only noteworthy thing that stood out was a high hit rate against numeric email address aliases from Facebook also seen in the (most likely fabricated) Badoo incident. Inverting that number and pro-rata’ing to the entire data set, I’d never seen more than 4M of the addresses. So I loaded the data.” said in the post published by Troy Hunt.
The database contained a total of 755 files totalling 1.8GB.
Users are always advised to use strong passwords and use different passwords for different accounts. Always enable multi-factor authentication.
You may be interested in reading:Mac Adware Doctor App Discovered Stealing Sensitive Information of Users