Russian criminals steal 1.2 billion passwords

By James O'Toole and Jose Pagliery, @CNNTech

NEW YORK - Russian criminals have stolen 1.2 billion Internet user names and passwords, amassing what could be the largest collection of stolen digital credentials in history, a respected security firm said Tuesday.

The firm, Milwaukee-based Hold Security, didn't reveal the identities of the targeted websites, citing nondisclosure agreements and a desire to prevent existing vulnerabilities from being more widely exploited.

Hold Security founder Alex Holden told CNNMoney that the trove includes credentials gathered from over 420,000 websites -- both smaller sites as well as "household names." The criminals didn't breach any major email providers, he said.

A credential pair consists of a user name -- often an email address -- plus a password. There are roughly half a billion email addresses in the gang's collection, Hold Security says.

Holden said the gang makes its money by sending out spam for bogus products like weight-loss pills. That means that if you see strange messages being sent from your email or social media accounts, you might be among those affected.

"It's really not that impactful to the individuals, and that's why they were under the radar for so long," Holden said. "They've ignored financial information almost completely."

But Holden said the gang's success at amassing passwords demonstrates that weak security procedures are common on websites of all sizes.

The criminals began collecting user data a few years ago by simply buying it on the black market. Their stash has grown significantly this year thanks to their use of an automated program that trawls the Internet to find vulnerabilities on websites, Holden said.

The reported theft dwarfs the one revealed last year by discount retailer Target (TGT), which admitted in December that hackers had stolen credit- and debit-card data from 40 million accounts.

Hackers from Russia and Eastern Europe are known for launching sophisticated cyberattacks for financial gain. Beyond spam, organized crime syndicates in the region have engaged in more sophisticated activities like corporate espionage and the theft of credit-card details.

The extent of the theft shows people need to better manage their credentials, cybersecurity experts say. Most people keep the same password for multiple services, such as banking, email and social media accounts. That allows hackers to turn a single password database into a treasure trove.

One simple way to stem the damage is to use two-factor authentication whenever possible to sign into online services, said Eric Cowperthwaite, an executive at network security provider Core Security. This method requires you to enter a second password, usually generated by your smartphone, upon login.

Jay Kaplan, CEO of cybersecurity firm Synack, criticized the companies involved for not being alert enough about their own security.

"It's likely that most of them do not even realize how many times they've been compromised," he said.

"This happens quite often. The more advanced we become with Internet and software, you see more and more of this," News4Jax crime and safety analyst Gil Smith said.

He said the best thing you can do now is change your password and username on all of the websites you frequent.

"We tend to be lax online because we're in the comfort of our own home and we don't see any danger, but it's still the same people who are out there and are willing to take advantage of you," Smith said.

"You need to have safe passwords that aren't obvious, usually a phrase or a random word," said Bethany Barnes, of Future Computer Systems.

Barnes said it's good to change your password every 90 days and to have a different password for every account you have.

Barnes said using apps on your smartphone to manage all of your passwords helps you remember them and stay safe.

Copyright 2014 by CNN and All rights reserved. This material may not be published, broadcast, rewritten or redistributed.