The stolen logins can obviously be used to access email accounts, but users who tend to have the same password for multiple websites are even more vulnerable. Microsoft, which saw as many as 33 million Hotmail accounts stolen in this breach, has stated that it has security measures in place to protect against accounts being compromised. After eliminating redundant entries, the security outfit counted 57 million Mail.ru accounts, just 7 million shy of the monthly active email users the service said it had at the end of 2015.
Advertisement
Hold Security’s Alex Holden, who reported the data breach, told Reuters that the breach affects numerous email addresses on Russia’s popular Mail.ru service, as well as addresses from Google, Yahoo and Microsoft. Data of other small email services from China, Germany, and other countries has also been stolen. It was not clear if any of these accounts had actually been breached.
Thousands of email addresses and passwords in the list were of the employees from banking, retail, and manufacturing sector in the US. Apparently, Google, Yahoo and Hotmail accounts are among the stolen credentials now being traded in Russian Federation.
The security firm that discovered the breach, Hold Security, believes that numerous accounts involved in this leak have not been previously leaked. The hacker, who has been nicknamed as “The Collector”, is asking for just 50 rubles – less than Dollars 1 – for the lot. Later, they agreed to give the information to Hold for free as long as they said “favorable comments” about him in hacker forums, according to Reuters.
Mail.ru has also come out with a statement saying, “As soon as we have enough information we will warn the users who might have been affected”.
Google and Yahoo haven’t responded yet.
A Microsoft spokesman added. He said that this was one of the biggest stashes of stolen usernames and passwords ever since the cyber-attacks on United States banks two years ago. We’ll update this article when we hear more.
Advertisement
Microsoft didn’t affirm whether its users were affected by the data dump, but it did say that the posting of passwords is a problem.
