Russian crime ring reportedly nabbed 1.2 billion online credentials

Russian crime ring reportedly nabbed 1.2 billion online credentials

Summary: Target's security breach almost pales in comparison to what might be the largest swath of stolen Internet credentials ever.


On the heels of the admittance of just how much the severe cyber attack on Target cost the retailer comes the revelation of what might be the largest swath of stolen Internet credentials ever.

A crime ring based in Russia is said to have stolen more than 1.2 billion Internet credentials (usernames and passwords) with more than 500 million email addresses, according to the New York Times on Tuesday.

The news organization accredited the find to Milwaukee-based Hold Security, a technology and business intelligence firm that both provides enterprise security infrastructure and conducts incident investigations for clients worldwide.

Names of targeted websites and victims has not been published, but it was noted that the culprits have hacked into websites great and small.

Even more curious is that most of the IDs that have been exploited thus far have been used for indirect financial returns, namely for sending spam on social networks rather than vast illegal spending and selling the credentials on the black market.

Earlier on Tuesday, Target -- which arguably became the poster child for extraordinary data breaches -- admitted that it saw net expenses of $110 million from the attack on its payments infrastructure last winter.

Costs from the breach consist of losses for the majority of actual and potential breach-related claims, including those from payment card networks.

In Target's case, hackers thought to have been based in Eastern Europe got their hands on the names, mailing addresses, phone numbers and email addresses for up to 70 million people.

In response to Target's estimation of the financial costs of the incident (although customer trust might be priceless), analysts surmised it could have been much worse.

In reflection of how many more people have been revealed to be vulnerable thanks to this latest sting, that sentiment rings even more true.

Topics: Security, Legal, Privacy, Tech Industry

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Hmmm

    Wonder if Putin gets a cut.
  • !

    Are the bad guys really so much brighter than the numpties employed by big business?
    dumb blonde
    • !

      Yes and no. A very few of them are very bright indeed. Remember, you'll only ever hear about their big 'successes'. However, always remember that it is much harder to defend than attack - you need to defend every possible attack vector, not just the one that an attacker uses. That's a big ask, especially when the vendors (or black hat groups) keep publishing new vulnerabilities. On the other hand, yes, some firms do not take security seriously enough and even though they have individuals or teams responsible for this vital area, they might either pay poorly or recruit badly resulting in sub-standard staff. I'm sure this is the exception rather than the rule though.
      • Apparently many corporations, regardless of size,....

        seem to concentrate more on overt financial management, which can also lead to compromises in ability of any IT staff employed. If they have an "ostrich" syndrome regarding security, it can be that much worse, because they will never give IT abilities of proper priorities & skills to protect as well as enable the business. Have to wonder if (M)BAs ever get exposed to the security side of things....
    • Well, apparently much brighter than....

      the "general online populace" who seem to not only consciously ignore needs for decisions in favor of security, but also seem to be infected with the "it can't happen to me" virus.
  • hackers

    These guys really need to step away from the computer go out and get some girlfriends. ...
    • Oh, but they need cash....

      to impress & win any potential girlfriend, don't they? LOL
  • More Russia bashing

    Anyone see a pattern or agenda?
  • Oh come on,

    these guys at Hold Security offer a free for one month option (later on you have to pay them!!!), so that you can learn if your email (and passes) is compromised.. You must provide them your name (what on earth for???) and email and in a second stage they propose you send them (encrypted by a ...."very secure" algorithm they have built) ALL your passes so they can tell you which of them have been stolen.. Check it out
    • Ha...

      That's funny, but probably true. I can't even remember some of my usernames, let alone all the passwords - I randomize each password, and change them weekly - sounds like a lot, but it's only 83 accounts, so it's not a big deal.
  • Isn't anyone wondering about the who and where?

    "Names of targeted websites and victims has not been published, but it was noted that the culprits have hacked into websites great and small."
  • The author needs "grammar-check"

    "Names of targeted websites and victims has not been published,"

    "Names (of targeted websites and victims) HAVE not been published." Please, get it right! I am not an English major, I simply play one on the Internet.

    The phrase "of targeted websites and victims" is a modifier and is considered "parenthetical;" i.e., if you remove that phrase, then it demonstrates how to deduce the proper verb tense needed; hence, "Names... HAVE not been published." It's an old grammar trick; try it. You would never write "Names... has not been published;" it's simply incorrect.
    • Police

      I see the grammar police are right on cue. It must be exhausting to have to proof read all these articles every day. I just wonder how many people actually care about minor grammar mistakes......
      • grammar police

        Maybe some people just care about attention to detail and pride in workmanship than you do. Presumably, the author is getting paid for their work. It takes 2 minutes to proofread this before it gets published to the world. They obviously don't care and (apparently) doesn't either.

        The less we care about details, the more we'll accept mediocrity. I hope you take what you do for a living more seriously than this person does. Either that, or I hope you're not a surgeon or manage payroll.
  • if not the websites, how about the server software?

    OK... so i can see not blatantly revealing the names of the compromised websites (yet).

    But for those of us who care, at least please reveal the hosting software, so that we can make "intelligent" guesses about our own ISP's servers.

    (and so we'll know who to bash, of course)