Have I Been Pwned (HIBP), a website that allows Internet users to check whether their personal data has been compromised across multiple data breaches, has added an unbelievable 361 million email addresses, including login data stolen by password-stealing malware in credential stuffing attacks or data breaches.
These stolen credentials were collected by cybercriminals from many Telegram cybercrime channels.
They consisted of email addresses and passwords stolen through credential stuffing attacks or data breaches, usernames and passwords along with the URLs associated with them, and raw cookies, both stolen through password-stealing malware.
According to BleepingComputer, the researchers who asked to remain anonymous shared 122 GB of credentials with Troy Hunt, the owner of Have I Been Pwned, collected from thousands of Telegram channels.
Hunt says that the data trove is huge. It contains 361 million unique email addresses, of which 151 million were never seen by the data breach notification service before.
“It contained 1.7k files with 2B lines and 361M unique email addresses of which 151M had never been seen in HIBP before. Alongside those addresses were passwords and, in many cases, the website the data pertains to,” posted Hunt in his blog post.
Although the dataset of previously unseen email addresses is huge, Hunt confirmed the authenticity of many of the leaked email addresses by using the password reset forms on the affected websites.
This enabled him to verify that many email addresses were correctly associated with the website listed in the stolen credentials.
However, Hunt could not confirm the password, as access to the accounts was not possible due to legal reasons.
However, if you believe that you are a victim of the leaked data, it is recommended that you change all your passwords — both in the password manager and on websites that use the same login credentials.
