A Russian hacker who stole more than 270 million email accounts is selling those credentials in Russia's criminal underworld, according to Reuters.
Hold Security, the agency that discovered the breach, found out that the Russian hacker, calling himself "the Collector," boasted giving all those credentials away, which amassed a total of 1.17 billion records. After the company sorted out and removed duplicates, it discovered a massive 272.3 million compromised accounts.
"I am just getting rid of it but I won't do it for free," the hacker reportedly wrote to the analysts, according to Tech Insider.
Majority of the stolen accounts (57 million) were from Mail.ru, the largest email service provider in Russia. And some of the other portions were divided among Gmail with 24 million, Yahoo Mail with 40 million and Microsoft Hotmail, with 33 million, Alex Holden, founder and chief information security of Hold Security, said. Other providers affected were from Germany and China, but Yahoo! Tech reported that it is unclear whether these accounts have actually been breached.
"This information is potent. It is floating around in the underground and this person has shown he's willing to give the data away to people who are nice to him," Holden said. "These credentials can be abused multiple times."
The young Russian hacker is purportedly asking just 50 roubles (less than a dollar) for the data. The company obtained a copy after posting a positive comment in the forum but did not pay for the data, as it was against the company's protocol.
Affected companies, on the other hand, assured they will respectively investigate the matter.
"We are now checking whether any combinations of usernames/passwords match users' emails and are still active," a Mail.ru representative told Reuters. "As soon as we have enough information, we will warn the users who might have been affected."
"We've seen the reports and our team is reaching out Hold Security to obtain the list of accounts now. We'll update going forward," Yahoo told Tech Insider.
Tech Insider suggests users to upgrade their respective accounts to stronger passwords and also activate two-factor authentication to avoid hackers from breaching with merely a piece of users' login information.
