A massive credential leak recently came to light that may affect you. Cybersecurity researcher Jeremiah Fowler discovered a publicly accessible database containing more than 149 million unique usernames and passwords from hundreds of services. This treasure trove of information was compiled from records stolen by infostealer malware that quietly harvested login data from infected devices and uploaded it to a cloud repository that was left unsecured and unencrypted.
Among the exposed data were around 48 million Gmail credentials alongside logins for Facebook, Instagram, Yahoo, Outlook, Netflix, Binance and many others. Records also included email addresses, passwords, and direct login URLs, giving attackers an easy way to use the information for credential-stuffing, phishing, or account takeovers; perhaps all of the above.
Millions of users around the world could be affected. What makes them more vulnerable to any kind of breach is when Gmail (or other) credentials are used to log into other accounts. You know how sometimes a site will offer to use your Gmail login to get into Facebook (or vice versa)? Don’t do that. Each website should have it’s very own set of login credentials. And storing them in the browser can open up a world of hurt too.
If you were one of the victims of this attack, or any that steals login credentials, immediately change passwords, enable two-factor or passkey login, check whether your email appears in breach databases like Have I Been Pwned, and scan your devices for malware.
Let’s not forget how the info stealer likely infected devices in the first place—via phishing. Always be skeptical of links or attachments in email or that arrive via text that you’re not expecting or that come from unknown senders. Also, if there is something that makes it seem like you need to make a snap decision, it’s most likely someone (or thing) trying to get sensitive details from you. If something is so urgent that you can’t take a moment to consider it, it’s not likely going to arrive in text or email.
Then there’s the problem of passwords. If you just cannot keep track of all the passwords, use help. You can write clues to your passwords, create a system such as including characters from the website into a base password, or writing them down in a notebook and storing it safely out of view. Password managers are also an option, but keep in mind that if they are compromised, so is your information; and there have been plenty of examples of password managers getting breached. This has happened with both LastPass and 1Password within the past few years.
Just for fun, the list of credentials most often seen in the stolen loot:
- Gmail-48 million
- Facebook-17 million
- Instagram-6.5 million
- Yahoo Mail-4 million
- Netflix-3.4 million
- Outlook-1.5 million
- .edu email accounts-1.4 million
Remember, there are ways to keep your information safer. You just have to keep those peepers open and trust your gut. If it’s a bit suspicious, just don’t click it.
SUBSCRIBE TO WEEKLY NEWSLETTER
