Cybersecurity researchers sounded the alarm this week after discovering the “mother of all security breaches” (MOAB).
With 26 billion records leaked online, experts say this is the largest data leak in history.
Confidential records from popular sites such as Twitter, Dropbox and Linkedin have been discovered on an unsecured website, which experts say could trigger a “tsunami of cybercrime”.
So is your data safe?
Following the news, experts told Web how you can check whether your emails or passwords have been compromised.
The easiest way to determine if you've been affected is to use a data breach checker like this one from Cybernews. The researchers say they have logged over 70 percent of the files affected by the breach and plan to fully update the auditor by the end of the week
Cybersecurity researchers warn it's almost certain your personal information was exposed in the “mother of all security breaches” that leaked 26 billion records on an unsecured website
Yesterday, researchers from Cybernews and Bob Dyachenko, owner of SecurityDiscovery.com, announced that they had uncovered a massive data breach.
The researchers found that 12 terabytes of data were stored on an open instance, hidden on the Internet.
This data included billions of username and password combinations as well as highly sensitive personal information.
The researchers warn that this data set could be “extremely dangerous” in the hands of criminals.
The easiest way to check if your information is included is to use a data leak checker like Cybernews Data Leak Checker.
To use this tool, simply enter your mobile number or email address in the search bar and click “Check Now”.
Mantas Sasnauskas, head of security research at Cybernews, told Web the team is working to ensure the tool contains all records related to this new breach.
Mr. Sasnauskas says more than 70 percent of the records leaked in the MOAB breach have already been registered on the tool.
Because MOAB involves a combination of historical breaches and new material, only about a third of the leaked data has not been previously published.
This means the data breach checker will likely continue to show whether your data was included in the most recent breach.
Mr. Sasnauskas and his team are currently combing through the remaining 30 percent of new leaks to determine which accounts have been compromised.
If you use any of these websites, there is a good chance that your data has been leaked. While some records are certainly duplicates, these sites leaked over 100 million personal records each
If you're particularly concerned about your account with a particular site, Cybernews has also created a searchable list of affected sites.
You may also be able to tell that an account has been hacked if you notice suspicious activity on one of your accounts.
Receiving login notifications from one of your accounts that you don't recognize may be an indication that someone has gained access.
However, given the scale of the breach, Mr Sasnauskas warns that you will almost certainly be affected.
He told Web: “The majority of the population is probably affected.”
Due to the sheer volume of records leaked from popular websites like Linkedin, experts believe that the majority of the population will have at least one account that is at risk from this leak
Researchers estimate that this breach contains well over 15.5 billion unique password and account combinations from 3,386 different websites – more than 20 of which published hundreds of millions of records.
The largest leak came from Tencent's QQ, a popular Chinese messaging app, where 1.5 billion records were affected.
Some of the other biggest leaks came from MySpace (360 million), Twitter (281 million), Linkedin (251 million) and AdultFriendFinder (220 million).
So if you're an internet user, it's almost certain that at least one account you use has been affected by the security breach.
Jake Moore, global cybersecurity advisor at ESET, told Web that people should assume their accounts have been compromised.
Experts warn that you should take this opportunity to change your passwords. Using X, which leaked 281 million records, hackers can access any account using the same password
The biggest risk is that hackers can gain control of an account and use it to access other accounts belonging to the same person.
Mr Moore told Web: “Unfortunately, many people still use their favorite passwords across multiple websites, causing this type of beach to spread very quickly.”
“So people should take this announcement as an opportunity to make their passwords unique, but also add multi-factor authentication to their accounts.”
Mr. Moore also warns that even compromising an old account that you no longer use risks a cascade of even more dangerous attacks.
“Criminals can achieve a huge amount by accessing accounts that may contain other personal information such as home address or telephone number,” he says.
Brian Martin, director of product management at Integrity360, says: “Threat actors are known to create private copies of previous security breaches to support their malicious activities.”
Mr. Martin explains that this breach data is extremely useful for launching “phishing, social engineering and credential stuffing attacks.”
He recommends organizations and individuals practice good cyber hygiene to limit the risk of future attacks.
This includes resetting passwords, using two-factor authentication and being aware of phishing techniques.
Mr Martin added: “It has always been the case that not having these basic cyber hygiene measures increases your risk, but the risk increases with the availability of such a comprehensive compilation database of readily available information.”
The presence of massive data dumps like this significantly increases the risk of future cyber attacks, as criminals can use the account information from a leak to break into others
The researchers who discovered the breach say the person behind it will likely never be identified.
However, Mr. Sasnauskas suspects it was created by someone trying to create a criminal marketplace for private information.
He added: “There have been services like this in the past and they sometimes pop up.”
“Basically, you could enter anyone’s email address and for a few dollars buy the passwords to their accounts.”
It's also possible that this was put together by a data broker or other organization that works with massive amounts of data.
However, Mr. Sasnauskas says it is more likely that it was created by a malicious actor.
How to check if your email address is compromised
Have I been pwned?
Cybersecurity expert and Microsoft regional director Tory Hunt hosts “Have I Been Pwned.”
On the website you can check whether your email has been compromised as part of any of the data breaches that have occurred.
If your email address is displayed, you should change your password.
Pwned passwords
To check whether your password may have been exposed in a previous data breach, go to the site's homepage and enter your email address.
The search tool compares it with the details of historical data breaches that made this information publicly visible.
If your password is exposed, you are likely at higher risk of being exposed to hacking, fraud, and other cybercrimes.
Mr Hunt developed the website to help people check whether or not the password they want to use is on a list of known hacked passwords.
The website does not store your password along with any personal information and each password is encrypted
More safety tips
Hunt offers three easy-to-follow steps for better online security. First, he recommends using a password manager like 1Password to create and store unique passwords for each service you use.
Next, enable two-factor authentication. Finally, stay informed of any violations