- Researchers found 30 databases housing 16 billion records online
- The records were most likely generated by infostealers
- Records come from a wide range of providers, from Apple to Google and many more
Security researchers have reported discovering what could be the mother of all data breaches – a set of 30 databases containing a total of 16 billion records.
These records were most likely generated by various cybercriminals (and possibly white hat hackers or researchers) using different infostealing malware, a new report from Cybernews claims.
The researchers note the databases differed in size – from “smaller” ones containing just millions of entries, to gigantic ones housing billions of records, with accounts from Google, Apple, to various VPN services, GitHub, Telegram, and more – and of the 30 discovered datasets, just one had been previously reported by the media, a “mysterious” database with 184 million records.
Scratching the surface
“It barely scratches the top 20 of what the team discovered,” Cybernews explained. “Most worryingly, researchers claim new massive datasets emerge every few weeks, signaling how prevalent infostealer malware truly is.”
The databases were available to the wider internet only briefly, and were quickly locked down – however, it wasn’t possible to determine who the owners are.
It is probable that many of the information overlaps, making it virtually impossible to determine exactly how many people were affected. It’s also important to note that some 5.5 billion people have access to the internet today, meaning that many people have multiple compromised accounts.
Unprotected databases continue to be the most common cause of data leaks. For years, security researchers have been warning that many organizations do not understand the shared responsibility model of cloud services, and that they are required to safeguard and secure the data they generate.
On the other hand, cybercriminals are having a field day with these archives. They often contain more than enough of sensitive information to launch highly personalized, successful phishing campaigns, leading to identity theft, wire fraud, and even ransomware attacks.
Leave a comment