On July 4, 2024, a record-setting data leak occurred. “Cybernews” reports that nearly 10 billion unique passwords were posted to the dark-web. The staggering 9,948,575,739 unique passwords are a mix of old and new data breaches. Listed in a hacker forum as rockyou2024.txt, these passwords were in plaintext. ‘Plaintext’ means that these passwords are not encrypted – they are actual passwords, released in a text file.
According to the hacker, the new release is based on RockYou2021’s 8.4 billion records from 2021. Specifically, the hacker updated the older file with 1.5 billion passwords obtained between 2021 and 2024. “Cybernews” explains that the RockYou2021 compilation was an expansion of a data leak from a 2009 leak which included tens of millions of user passwords for social media accounts.
The hacker posted “I updated rockyou21 with collected new data from recent leaked databases in various forums over this and last years.” Estimates suggest that the RockYou2024 file contains entries from 4,000 large databases of stolen credentials, spanning at least 20 years.
Data leak can target any system
Importantly, this data leak can target any system. The author believes that attackers can utilize the ten-billion-strong RockYou2024 compilation to target any system that isn’t protected against brute-force attacks. This includes everything from online and offline services to internet-facing cameras and industrial hardware.
“Cybernews” describes the RockYou2024 data leak file as “a mix of old and new data breaches,” indicating it may not be a new breach of 10 billion passwords. Nonetheless, compiling all these passwords into one massive, searchable database, they warn, “substantially heightens the risk of credential stuffing attacks.“
Data breach enables attacks
Credential stuffing occurs when hackers use automated scripts to try various combinations of stolen usernames and passwords from different data breaches to hijack people’s accounts. For instance, someone might use a password obtained from the AT&T breach to see if you use the same password for your bank account.
To check if your passwords are compromised, visit these websites:
RB-
The RockYou2024 data leak list is new, so at the time of this writing, it’s unclear if any private data has been compromised as a direct result of this compilation. Anyone using online services should assume their passwords could be on this list.
In the meantime, don’t freakout about RockYou2024. Experts recommend:
- Continue your activities while adhering to password best practices, such as regularly changing passwords.
- Set up a password manager.
- Enable MFA wherever possible.
Related article
Ralph Bach has been in IT for a while and has blogged from the Bach Seat about IT, careers, and anything else that has caught my attention since 2005. You can follow me on Facebook. Email the Bach Seat here.
– Updated 10/28/2023- The data breach at 23andMe must be really bad. The data breach has drawn the 
– Updated 10/27/2923 – This data breach compromised 230,000 individuals according to the 

The Kids Online Safety Act, known as KOSA, is another half-assed publicity grab. The politicians fail to address the root cause of the problem – data collection. We can all agree that social media is bad for kids. There is enough proof from
To begin with, the
The KOSA requirements would mandate that platforms have parental controls. These government-mandated controls could be harmful to kids in abusive situations.
KOSA would give the President control over what people see online. The government would create a
According to Fight for the Future, the bill would incentivize sites to collect even more information about children to verify their ages and place further restrictions on minors’ accounts. They explain,
KOSA would also create unintended consequences. The unintended consequences include driving children to use less secure or more harmful platforms. The Kids Online Safety Act would make kids more vulnerable to online predators who could exploit their age verification information. It would also undermine the trust and communication between children and parents, as well as between platforms and users.


Speculation is
Information exposed in data breaches like this is commonly used by attackers to target users with phishing attacks or attempt to reset passwords to gain account authorization. This is why