Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
It seems that the recent data breach that was thought to be the largest in history and that allegedly exposed 8.4 billion passwords it’s not a new password breach after all as proved by the security specialists from Privacy Sharks.
It’s possible that the passwords were gathered from past data breaches and it looks like the passwords from the collection are ranging from being made out of 6 to 20 characters with non-ASCII characters and white spaces removed.
The user that leaked the passwords is claiming that the list has 82 billion passwords, but CyberNews refuted this claim, as in its own test has found around 10 times fewer entries, therefore the number of stolen passwords being closer to 8.4 billion.
8.4 billion is still a substantial number, especially when taking into consideration the fact that around the world there are 4.7 billion active internet users.
The user named the released collection RockYou2021, which is believed to be a reference to the 2009 RockYou data breach in which the social game developer RockYou was hit by an attack that exploited a SQL injection flaw.
In this specific incident, 32 million passwords that previously had been stored in an unencrypted format were leaked.
In the 2021 version of RockYou, there are so many passwords probably because they were gathered from leaked databases, like the Compilation of Many Breaches (COMB), that revealed more than 3.2 billion unique pairs of emails and passwords in cleartext.
Should You Be Concerned?
It can be concerning that the RockYou2021 compilation contains details of potentially compromised accounts and leaked passwords but users should remain calm as many of these were previously breached.
Moreover, RockYou2021 isn’t just a list of breached credentials and passwords; it’s a collection of various lists such as probable passwords and wordlists. We’ve examined the list to give you the low-down on what exactly this cybersecurity breach entails.
So, it seems that a lot of this leaked data had already been exposed in previous breaches. This means that the commotion caused by various online outlets is uncalled for; individuals have had access to the leaked credentials and entries in RockYou2021 for a long time.
Users that are concerned about the leaked passwords and other sensitive information being breached can take a few actions, like using a reputable data leak checker just as Have I Been Pwned, change their password immediately, start using a password manager, make sure they have enabled the multifactor authentication on all the accounts where this is possible, and also pay attention for an increase in spam and phishing emails.
Companies and users need to treat these developments as a wake-up call to end their overblown reliance on passwords. Passwordless authentication methods such as phone as a token and/or FIDO2 security keys are now commonly available. Such solutions create an un-phishable connection between the user and the IT system and eliminate the need for a password, thereby reducing the attack surface and making the environment more resilient against cyberattacks.
Unfortunately, most people have the tendency to reuse their passwords across multiple apps and websites, therefore the number of accounts possibly affected by credential stuffing and password spraying attacks in the wake of this leak can be massive.
Heimdal® Network DNS Security
- No need to deploy it on your endpoints;
- Protects any entry point into the organization, including BYODs;
- Stops even hidden threats using AI and your network traffic log;
- Complete DNS, HTTP and HTTPs protection, HIPS and HIDS;
Dora is a digital marketing specialist within Heimdal™ Security. She is a content creator at heart - always curious about technology and passionate about finding out everything there is to know about cybersecurity.
