On July 4, 2024, a record-setting data leak occurred. “Cybernews” reports that nearly 10 billion unique passwords were posted to the dark-web. The staggering 9,948,575,739 unique passwords are a mix of old and new data breaches. Listed in a hacker forum as rockyou2024.txt, these passwords were in plaintext. ‘Plaintext’ means that these passwords are not encrypted – they are actual passwords, released in a text file.
According to the hacker, the new release is based on RockYou2021’s 8.4 billion records from 2021. Specifically, the hacker updated the older file with 1.5 billion passwords obtained between 2021 and 2024. “Cybernews” explains that the RockYou2021 compilation was an expansion of a data leak from a 2009 leak which included tens of millions of user passwords for social media accounts.
The hacker posted “I updated rockyou21 with collected new data from recent leaked databases in various forums over this and last years.” Estimates suggest that the RockYou2024 file contains entries from 4,000 large databases of stolen credentials, spanning at least 20 years.
Data leak can target any system
Importantly, this data leak can target any system. The author believes that attackers can utilize the ten-billion-strong RockYou2024 compilation to target any system that isn’t protected against brute-force attacks. This includes everything from online and offline services to internet-facing cameras and industrial hardware.
“Cybernews” describes the RockYou2024 data leak file as “a mix of old and new data breaches,” indicating it may not be a new breach of 10 billion passwords. Nonetheless, compiling all these passwords into one massive, searchable database, they warn, “substantially heightens the risk of credential stuffing attacks.“
Data breach enables attacks
Credential stuffing occurs when hackers use automated scripts to try various combinations of stolen usernames and passwords from different data breaches to hijack people’s accounts. For instance, someone might use a password obtained from the AT&T breach to see if you use the same password for your bank account.
To check if your passwords are compromised, visit these websites:
RB-
The RockYou2024 data leak list is new, so at the time of this writing, it’s unclear if any private data has been compromised as a direct result of this compilation. Anyone using online services should assume their passwords could be on this list.
In the meantime, don’t freakout about RockYou2024. Experts recommend:
- Continue your activities while adhering to password best practices, such as regularly changing passwords.
- Set up a password manager.
- Enable MFA wherever possible.
Related article
Ralph Bach has been in IT for a while and has blogged from the Bach Seat about IT, careers, and anything else that has caught my attention since 2005. You can follow me on Facebook. Email the Bach Seat here.
