*Mother of all Breaches
Reports are circulating online about the discovery of a data dump of breached records totaling 26 Billion records spread across 3,800 folders with a file size in excess of 12TB. Each folder represents the data from a specific company / website breach.
The data dump was discovered by Bob Dyachenko, cybersecurity researcher and owner at SecurityDiscovery.com and a team of researchers from Cybernews.
A full list of the sites contained in the breach can be downloaded here.
It is early days at the moment and the full dump has yet to be completely scanned to determine if the datasets contain any new records or is just a collection of previously seen data dumps, but the sheer size of the collection suggests that there is a high likelihood that it does contain previously unseen data.
It is unknown who is responsible for the curation of this huge dataset, or how many others have access to it, but the research team who discovered the dataset said “The dataset is extremely dangerous as threat actors could leverage the aggregated data for a wide range of attacks, including identity theft, sophisticated phishing schemes, targeted cyberattacks, and unauthorized access to personal and sensitive accounts,”
In addition to the above risks, a dataset of this magnitude would be very useful to train an AI system to automate attacks and predict what other credentials might be.
The largest number of records (1.4B) comes from Tencent, a Chinese instant messaging app., however, there are hundreds of millions of records from other popular sites including:
- Weibo (504M)
- Twitter (281M)
- Deezer (258M)
- Linkedin (251M)
- AdultFriendFinder (220M)
- Luxottica (206M)
- MyFitnessPal (151M)
- Adobe (153M)
- JD.com (142M)
- Canva (143M)
- VK (101M)
- Daily Motion (86M)
- Dropbox (69M)
- Telegram (41M)
The data certainly contains old breach information as well as new – At some point I suspect the data will be shared with Troy Hunt – owner of HaveIbeenPwnd and his system will quickly be able to identify how much is new data.
To check to see if your credentials have been included in a data breach – enter your email address or phone number at https://haveibeenpwned.com/
If you discover your data has been included, follow the advice below:
- Change the password used for the account
- Ensure you use a strong, memorable set of credentials – consider ThreeRandomWords
- Ensure you have not recycled the same credentials on any other accounts
- Check your email for any suspicious messages purporting to be from / about the account
- Enable Multi-Factor Authentication (MFA) on the account if available
- Consider using a password manager tool
