Russian Crime Ring Holds Largest Cache of Stolen ‘Net Credentials

Businesses large and small were targets of data theft

It seems every time we hear about a record-setting cyber crime, news of an even bigger one rolls around the corner. Cue the latest revelation – that a collection of stolen Internet credentials, including some 1.2 billion username/password combinations and more than 500 million email addresses, has been found in the ownership of a Russian crime ring.

The NY Times’ Nicole Perlroth and David Gelles report:

The records, discovered by Hold Security, a firm in Milwaukee, include confidential material gathered from 420,000 websites, including household names, and small Internet sites. Hold Security has a history of uncovering significant hacks, including the theft last year of tens of millions of records from Adobe Systems.

Hold Security would not name the victims, citing nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable. At the request of The New York Times, a security expert not affiliated with Hold Security analyzed the database of stolen credentials and confirmed it was authentic. Another computer crime expert who had reviewed the data, but was not allowed to discuss it publicly, said some big companies were aware that their records were among the stolen information.

“Hackers did not just target U.S. companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites,” said Alex Holden, the founder and chief information security officer of Hold Security. “And most of these sites are still vulnerable.”

Despite the massive numbers involved, the most interesting part of this case is contained in the last lines of the quote. Most of the hacks we have seen over the past couple years have been targeted solely at large organizations and their customers, overshadowing the fact that small businesses are at risk as well.

Whatever your organization does, whatever it’s size, these days it’s guaranteed that you’re making use of the ‘net to store a great deal of data you do NOT want criminals to get their hands on. Do your best to secure your systems, and prepare crisis management plans in case you’re outfoxed, because as long as cyber crime continues to be profitable, nobody is safe.