Security firm Hold Security has obtained 272 million unique combinations of email addresses and passwords from a Russian criminal. Of those, 42.5 million were not known to the company from previous cases.
It’s unknown how the Russian trader got the passwords, but he bragged that it came from multiple “hacks,” the company says. The fact that Hold Security encountered 42.5 million new combinations of usernames and passwords may also mean that the merchant has combined databases from hacks for which Hold Security has not amassed any databases.
The mail accounts are for the most part from the Russian service Mail.ru, but also come from Yahoo, Hotmail and Gmail. Given the number of sources, phishing is one of the most logical sources of data, although combining databases of data breaches from the past is also possible. Many people use the same usernames and passwords for many Internet services as they do for their email. A data breach at, for example, an online store can therefore mean that malicious parties can also log in to an email address.
Hold Security did not pay any money for the data, although the trader asked 50 rubles, which is about 65 cents. Instead, the company got its hands on the data by providing the trader with likes on Facebook. Hold Security specializes in trading data over the internet.