Millions of Accounts at Risk Following Major Data Leak
A trove of over 56 million email addresses and 124 million passwords, harvested from infected devices, has been added to the Have I Been Pwned database.
A significant data leak has exposed more than 56 million email addresses and 124 million passwords, raising concerns about the security of millions of online accounts. The compromised credentials were not the result of a breach at a specific company but were instead collected by infostealer malware from infected personal devices.
These malicious programs operate by quietly scanning computers for saved passwords, browser data, cookies, and other sensitive information, which is then sent to cybercriminals. The newly identified dataset is an aggregation of hundreds of millions of these "stealer logs," according to the service Have I Been Pwned (HIBP), which added the records to its database on June 15.
HIBP, a service that allows users to check if their personal information has been exposed in data breaches, is now making this information available to the public. Users can visit the HIBP website to determine if their email address is included in this latest leak.
Security experts are urging individuals to take immediate action if their credentials are found to be compromised. This includes changing passwords on all affected accounts and implementing stronger, unique passwords for each online service. The use of a password manager is recommended to generate and securely store these complex passwords.
Furthermore, enabling two-factor authentication is advised as an additional layer of security. This measure can prevent unauthorized account access even if a password has been stolen, as it requires a second form of verification.
The infostealer malware poses a growing threat as it allows attackers to directly harvest login credentials from victims' devices without needing to breach the online services themselves. This method has become a widely adopted tool among cybercriminals for accessing sensitive information and facilitating further attacks.
This incident follows a previous large-scale data exposure in November, where HIBP identified a collection of 1.3 billion passwords and nearly two billion email addresses online. With billions of internet users globally, security professionals caution that a proactive approach to password security is essential for all online users.