1.4 Billion Clear Text Credentials Discovered in a Single Database

[Slaters Kustum Machines]

A Massive Resource for Cybercriminals Makes it Easy to Access Billions of Credentials.

Now even unsophisticated and newbie hackers can access the largest trove ever of sensitive credentials in an underground community forum. Is the cyber crime epidemic about become an exponentially worse?

While scanning the deep and dark web for stolen, leaked or lost data, 4iQdiscovered a single file with a database of 1.4 billion clear text credentials — the largest aggregate database found in the dark web to date.

None of the passwords are encrypted, and what’s scary is the we’ve tested a subset of these passwords and most of the have been verified to be true.

https://medium.com/4iqdelvedeep/1-4...-discovered-in-a-single-database-3131d0a1ae14

 

[phaZed]

Gzuz

 

[GTP]

Gzuz

...on a unicycle!

 

[goldmercury]

Handy https://haveibeenpwned.com/

 

[Markverhyden]

What, no link to the database...... LOL!!!

 

[mraikes]

Gzuz

I had to Google this. And I still have no idea what it's referring to.

 

[phaZed]

I had to Google this. And I still have no idea what it's referring to.

It's a polite, "Jesus".

 

[Slaters Kustum Machines]

I had to Google this. And I still have no idea what it's referring to.

It took me a couple seconds to figure it out when I first read it.

 

[mraikes]

It's a polite, "Jesus".

Ah! That's makes more sense than the German rapper!

 

[fencepost]

I grabbed the 5GB torrent (but not the updates) of the 300+ million hashes from Have I Been Pwned but haven't done anything with it yet because it'd require dumping all my passwords, hashing them, then checking.

I'd actually like to get a copy of this (not that I'm going to) so I could check for a couple of specific domains rather than actual email addresses, including my personal domain because I do custom email addresses on my domain for many services. I generally have a decent idea of whose address lists have been compromised, because I start getting spam on the custom-to-them address I generated (e.g. I'm on my third address for United Airlines, but I just gave up actually changing it after the second time I changed it).

 

[ComputerRepairTech]

hmm I can't help but notice jesus is not in the list of common passwords and most of them are numbers or patterns. homelesspa? that kind of stands out perhaps a very large bot registered a bunch of accounts with that password?