Collection 2: Credential Bugaloo - Following Collection #1, Collections 2-5 found, containing 25 BILLION records combined

[rcmaehl]

Sources:
BGR
Wired
Hasso Plattner Institute Tool (Check your emails for breach here)
 

Summary:
Following Collection 1, containing 773 Million records. Collections 2-5 have been found, containing a total of 25 BILLION records. 32 times more than Collection 1 alone, and three times more unique usernames and passwords, 2.2 billion of which are unique.

 

Quotes/Excerpts:

Quote

Earlier this month, security researcher Troy Hunt identified the first tranche of mega-dump, named Collection #1 by its anonymous creator, a set of cobbled-together breached databases Hunt said represented 773 million unique usernames and passwords. Now other researchers have obtained and analyzed an additional vast database called Collections #2–5, which amounts to 845 gigabytes of stolen data and 25 billion records in all. After accounting for duplicates, analysts at the Hasso Plattner Institute in Potsdam, Germany, found that the total haul represents close to three times the Collection #1 batch. "This is the biggest collection of breaches we’ve ever seen," says Chris Rouland,... who pulled Collections #1–5 in recent days from torrented files. He says the collection has already circulated widely among the hacker underground: He could see that the tracker file he downloaded was being "seeded" by more than 130 people who possessed the data dump, and that it had already been downloaded more than 1,000 times. "It's an unprecedented amount of information and credentials that will eventually get out into the public domain," Rouland says. The leak is still significant for its quantity of privacy violation, if not its quality. WIRED asked Rouland to search for more than a dozen people's email addresses; all but a couple turned up at least one password they had used for an online service that had been hacked in recent years. As another measure of the data's importance, Hasso Plattner Institute's researchers found that 750 million of the credentials weren't previously included in their database of leaked usernames and passwords. The sheer size of the collection also means it could offer a powerful tool for unskilled hackers to simply try previously leaked usernames and passwords on any public internet site in the hopes that people have reused passwords—a technique known as credential stuffing. "For the internet as a whole, this is still very impactful," Rouland says. You can check for your own username in the breach using Hasso Plattner Institute's tool here, and should change the passwords for any breached sites it flags for which you haven't already. As always, don't reuse passwords, and use a password manager. (Troy Hunt's service HaveIBeenPwned offers another helpful check of whether your passwords have been compromised, though as of this writing it doesn't yet include Collections #2-5.)

 

My Thoughts:

Yet another collection of leaked usernames and passwords. If you haven't already, be sure to enable multi-factor authentication on your accounts and there's sure to be an increase in credential stuffing attempts following this news story.

[Spotty]

Dammit @rcmaehl you beat me to it. I knew this was coming. I even reserved a post for it.

 

 

[rcmaehl]

2 minutes ago, Spotty said:

Dammit @rcmaehl you beat me to it. I knew this was coming. I even reserved a post for it.

Well it's 1AM in Australia, but it's only 9AM here. You may be heading to bed but I just loaded up my work computer and news feeds when it popped up.  

[Spotty]

Just now, rcmaehl said:

Well it's 1AM in Australia, but it's only 9AM here. You may be heading to bed but I just loaded up my work computer and news feeds when it popped up.  

It's all good. I only learned of it from your post anyway.

 

9 minutes ago, rcmaehl said:

Now other researchers have obtained and analyzed an additional vast database called Collections #2–5, which amounts to 845 gigabytes of stolen data and 25 billion records in all. After accounting for duplicates, analysts at the Hasso Plattner Institute in Potsdam, Germany, found that the total haul represents close to three times the Collection #1 batch. "This is the biggest collection of breaches we’ve ever seen," says Chris Rouland,... who pulled Collections #1–5 in recent days from torrented files. He says the collection has already circulated widely among the hacker underground: He could see that the tracker file he downloaded was being "seeded" by more than 130 people who possessed the data dump, and that it had already been downloaded more than 1,000 times.

Ouch.

[sazrocks]

They need to load it into HIBP so the people with notifications set up can get a warning.

[captain_to_fire]

 

Basically my Outlook account was once screwed. Good thing my Gmail and iCloud email are not included. Looks like someone managed to steal my email password back when I was unaware that public wifi is risky or I could’ve been a victim of phishing back in the day. I don’t even know what Badoo is and someone signed up using my email. 

[williamcll]

57 minutes ago, VegetableStu said:

will wait for HIBP to add ._.

used my rando access email in the meantime. no hits so far

considering how big of a database it is, might take some time.

 

Unless Databases these days can run on GPU/NPUs

[sazrocks]

If you are willing to trust (I did), it would probably be better to use this tool, as it says if other data was paired with your email. HIBP on the other hand disassociates emails and passwords.

[rcmaehl]

23 minutes ago, sazrocks said:

If you are willing to trust (I did), it would probably be better to use this tool, as it says if other data was paired with your email. HIBP on the other hand disassociates emails and passwords.

I trusted it as well. I do really like how this tool displays what information was associated with the leak and has put me at ease about some of the older leaks.

[S w a t s o n]

1 hour ago, williamcll said:

considering how big of a database it is, might take some time.

 

Unless Databases these days can run on GPU/NPUs

Just need some of those new xeon 28 cores

[rcmaehl]

19 minutes ago, S w a t s o n said:

Just need some of those new xeon 28 cores

Quad Socket 4.5Ghz Xeons

[Guest]

oh dear not again  

[Noctus]

Jesus christ. 2.2Bil unique entries? Was only a matter of time something like this happened i guess.

[ScratchCat]

8 minutes ago, VegetableStu said:

i've been thinking.... you know those spam users in messageboards and forums? how many of them had their registering emails in there? o_o

Soon the spammers will be complaining about the spam.

[captain_to_fire]

9 minutes ago, VegetableStu said:

i've been thinking.... you know those spam users in messageboards and forums? how many of them had their registering emails in there? o_o

Makes me think that mods can see the actual email address used to sign up for the forum as well as the IP address 

[DrDerp]

Whew got lucky. I am pretty sure my old address is screwed though, glad I use all different passwords all the time now.

Too lazy to actually check that old address anyways, its basically useless at this point.

[rawrdaysgoby]

Just take it all already..... since I am sooo low profile online and my wallet is basically empty I doubt you will even care about my info

[Shreyas1]

15 hours ago, Spotty said:

Dammit @rcmaehl you beat me to it. I knew this was coming. I even reserved a post for it.

 

 

Don't worry, there's always collection 6, 7 and 8!

[YoloSwag]

17 hours ago, rcmaehl said:

Hasso Plattner Institute Tool (Check your emails for breach here)

This literally doesn't sound like a good idea.

It's like telling someone their phone number is on your phone then proceed to ask them if you could borrow your their phone to call yours just to prove it and viola. Pretty stupid scheme that people fall for tbh.

 

I know the point of it it's just that you know...

Just change all your passwords and re-do some multi-level authentication stuff.

[CiBi]

I assume these breaches date back to Collection #1 as well (where I was included in), spend a big part of my day then changing my recycled passwords to new unique ones so I'm not too bothered by this.

[rcmaehl]

6 hours ago, YoloSwag said:

This literally doesn't sound like a good idea.

It's like telling someone their phone number is on your phone then proceed to ask them if you could borrow your their phone to call yours just to prove it and viola. Pretty stupid scheme that people fall for tbh.

 

I know the point of it it's just that you know...

Just change all your passwords and re-do some multi-level authentication stuff.

I mean it's the same concept as HIBP's website. Verify 1 bit of information to before displaying the rest. It's not like it's an unknown website. It is the Official website for the Hasso Plattner Institute. Would be no different if Harvard or Yale was hosting the website. Regardless, you are correct, it's better to be cautious for stuff like this. Trust but Verify.

[YoloSwag]

2 hours ago, rcmaehl said:

I mean it's the same concept as HIBP's website. Verify 1 bit of information to before displaying the rest. It's not like it's an unknown website. It is the Official website for the Hasso Plattner Institute. Would be no different if Harvard or Yale was hosting the website. Regardless, you are correct, it's better to be cautious for stuff like this. Trust but Verify.

Hmm... this is out of topic but, is the saying "Trust but verify" a quote by someone?

I know a guy who says this a lot when I was working...

[BuckGup]

Where can you download this? Or at least check to see if your name is in it

[rcmaehl]

9 minutes ago, YoloSwag said:

Hmm... this is out of topic but, is the saying "Trust but verify" a quote by someone?

I know a guy who says this a lot when I was working...

Started out in Russia as a proverb, was adopted by Reagan during the Cold War and has gained popularity since then.

[rcmaehl]

4 minutes ago, BuckGup said:

Where can you download this? Or at least check to see if your name is in it

3rd link under sources. You have to have access to the email address you check.