Researchers from security firm 4iQ have now discovered a collective database, available on the dark web and torrent, that contains 1.4 billion usernames and passwords in clear text.
The aggregate database was first found on December 5th in an underground community forum, and has been said to be the largest ever aggregation of various leaks found in the dark web this date, noted 4iQ founder and chief technology officer Julio Casal.
Although the links to download the entire collection were already spreading over the dark web from the last few weeks, the news became viral when someone posted the information on Reddit.
The database that is around 41GB when first discovered, contains 1.4 billion usernames, email, and password combinations, all fragmented and sorted into two and three level directories. The database has also been organized and indexed alphabetically
The collective database contains plain text credentials leaked from Bitcoin, Pastebin, LinkedIn, MySpace, Netflix, YouPorn, Last.FM, Zoosk, Badoo, RedBox, Minecraft and Runescape, Anti Public, Exploit.in and others.
"None of the passwords are encrypted, and what's scary is that we've tested a subset of these passwords and most of the have been verified to be true," said Casal. "The breach is almost two times larger than the previous largest credential exposure, the Exploit.in combo list that exposed 797 million records."
"This new breach adds 385 million new credential pairs, 318 million unique users, and 147 million passwords pertaining to those previous dumps."
The data isn't fresh, but rather a compilation of past breaches, collated together into one database. Although some of the user credentials were quiet old and have been circulating on the web for for time, the success ratio is still high for criminals.
The reason for this is because users tend to be lazy to change their passwords, and have the habit of reusing their passwords across different platforms. Some have chosen easy-to-guess passwords that made things even worse.
The most common yet worst passwords found in the database are "123456", "123456789", "qwerty," "password" and "111111."
In the following weeks, Wordfence reported a massive upsurge in brute force login attempts following the leak, peaking at over 14 million attacks per hour.
