{"id":131684,"date":"2024-07-08T16:14:07","date_gmt":"2024-07-08T20:14:07","guid":{"rendered":"https:\/\/rbach.net\/?p=131684"},"modified":"2024-07-08T16:14:07","modified_gmt":"2024-07-08T20:14:07","slug":"massive-data-leak-exposes-10-billion-unencrypted-passwords","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/massive-data-leak-exposes-10-billion-unencrypted-passwords\/","title":{"rendered":"Massive Data Leak Exposes 10 Billion Unencrypted Passwords"},"content":{"rendered":"\r\n

\"Massive<\/a>On July 4, 2024, a record-setting data leak<\/strong> occurred. “Cybernews”<\/a> reports<\/a> that nearly 10 billion unique passwords<\/strong> were posted to the dark-web. The staggering 9,948,575,739<\/a> unique passwords are a mix of old and new data breaches. Listed in a hacker forum as rockyou2024.txt<\/strong>, these passwords were in plaintext. ‘Plaintext’ means that these passwords are not encrypted – they are actual passwords, released in a text file.<\/p>\r\n

\"updated<\/a>According to the hacker, the new release is based on RockYou2021’s 8.4 billion records from 2021.\u00a0Specifically, the hacker updated the older file with 1.5 billion passwords obtained between 2021 and 2024. “Cybernews” explains that the RockYou2021 compilation was an expansion of a data leak from a 2009 leak which included tens of millions of user passwords for social media accounts.<\/p>\r\n

The hacker posted\u00a0 “I updated rockyou21 with collected new data from recent leaked databases in various forums over this and last years.<\/em>” Estimates suggest that the RockYou2024 file contains entries from 4,000 large databases of stolen credentials, spanning at least 20 years.<\/p>\r\n

Data leak can target any system<\/h3>\r\n

\"data<\/a>Importantly, this data leak can target any system. The author believes that attackers can utilize the ten-billion-strong RockYou2024 compilation to target any system that isn\u2019t protected against brute-force attacks. This includes everything from online and offline services to internet-facing cameras and industrial hardware.<\/p>\r\n

“Cybernews” describes the RockYou2024 data leak file as “a mix of old and new data breaches<\/em>,” indicating it may not be a new breach of 10 billion passwords. Nonetheless, compiling all these passwords into one massive, searchable database, they warn, “substantially heightens the risk of credential stuffing attacks.<\/strong><\/em>“<\/p>\r\n

Data breach enables attacks<\/h3>\r\n

\"How<\/a>Credential stuffing occurs when hackers use automated scripts to try various combinations of stolen usernames and passwords from different data breaches to hijack people\u2019s accounts. For instance, someone might use a password obtained from the AT&T breach<\/a> to see if you use the same password for your bank account.<\/p>\r\n

To check if your passwords are compromised, visit these websites:<\/p>\r\n