Collection No. 1
Collection #1 is the name of a set of email addresses and passwords that appeared on the dark web around January 2019. The database contains over 773 million unique email addresses and 21 million unique passwords, resulting in more than 2.7 billion email/password pairs. The list, reviewed by computer security experts, contains exposed addresses and passwords from over 2000 previous data breaches as well as an estimated 140 million new email addresses and 10 million new passwords from previously unknown sources, and collectively makes it the largest data breach on the Internet.[1][2]
Collection #1 was discovered by security researcher Troy Hunt, founder of "Have I Been Pwned?," a website that allows users to search their email addresses and passwords to know if either has appeared in a known data breach.[3] The database had been briefly posted to Mega in January 2019, and links to the database posted in a popular hacker forum. Hunt discovered that the offering contained 87 gigabytes of data across 12,000 files. Not only was this discovery of concern to Hunt, but he further found that the passwords were available in plaintext format rather than in their hashed version. This implied that the creators of this database had been able to successfully crack the hashes of these passwords from weak implementation of hashing algorithms.[2] Security researchers noted that unlike other username/password lists which are usually sold on the dark web, Collection #1 was temporarily available at no cost, and could potentially be used by a larger number of malicious agents, primarily for credential stuffing.[2]
By January 30, 2019, security researchers observed that similar sets of data, named Collections #2 through #5, have been seen for sale on the dark web. Collections #2-5 included over 845 gigabytes of data, with a total of 25 billion email/password records. Security researchers at Hasso Plattner Institute estimated that Collections #2-5, after removing duplicates, has about three times as much data as Collection #1.[4] Many of the email/password pairs in the collection were found to be from previous breaches including the Yahoo! data breaches, and breaches from LinkedIn and Dropbox.[4]
Arrests
According to threat intelligence firm IntSights, Collection #1 through #5 had been compiled by a hacker known as Sanix; however, the data was leaked online by a rival data broker known as Azatej.[5] Both hackers were arrested in May 2020. Azatej was arrested in Poland,[6] and Sanix in Ukraine.[7]
References
- ↑ Song, Victoria (January 17, 2019). "Mother of All Breaches Exposes 773 Million Emails, 21 Million Passwords". Gizmodo. https://gizmodo.com/mother-of-all-breaches-exposes-773-million-emails-21-m-1831833456. Retrieved January 17, 2019.
- ↑ 2.0 2.1 2.2 Barrett, Brian (January 17, 2019). "Hack Brief: An Astonishing 773 Million Records Exposed In Monster Breach". Wired. https://www.wired.com/story/collection-one-breach-email-accounts-passwords/. Retrieved January 18, 2019.
- ↑ Goodin, Dan (January 17, 2019). "Monster 773 million-record breach list contains plaintext passwords". Ars Technica. https://arstechnica.com/information-technology/2019/01/hacked-and-dumped-online-773-million-records-with-plaintext-passwords/. Retrieved January 18, 2019.
- ↑ 4.0 4.1 Greenberg, Andy (January 31, 2019). "Hackers Are Passing Around a Megaleak of 2.2 Billion Records". Wired. https://www.wired.com/story/collection-leak-usernames-passwords-billions/. Retrieved January 31, 2019.
- ↑ "Massive 'Collection #1' Data Dump: What's In It and How Did it Happen?" (in en). https://intsights.com/blog/massive-collection-1-data-dump-whats-in-it-and-how-did-it-happen.
- ↑ Cimpanu, Catalin. "Europol arrests hackers behind Infinity Black hacker group" (in en). https://www.zdnet.com/article/europol-arrests-hackers-behind-infinity-black-hacker-group/.
- ↑ "В Івано-Франківську СБУ затримала відомого у світі хакера (додано відео)" (in en). https://ssu.gov.ua/ua/news/1/category/2/view/7602.
 |  |
