Another day, another data breach! Now, Russia's largest social networking site VK.com is the latest in a series of historic data breaches targeted by hackers, as they have done to social networking sites in the past.
The same hacker who previously sold data stolen from MySpace, Tumblr, LinkedIn, and Fling.com is now selling more than 100 million passwords from VK.com for just 1 Bitcoin (approx. US$580).
The database contains information such as full name (first and last names), email addresses, passwords in plain text, geographic information, phone numbers, and, in some cases, secondary email addresses.
Yes, plain text passwords. According to Peace, the passwords were already in plain text when VK.com was hacked.
So, if the website is still storing passwords in plain text today, this could pose a real security risk to its users.
The data breach was first reported by LeakedSource, the search engine, which obtained parts of the database from one of the people who bought it.
The company has already analyzed the contents of the hacked data and added it to its service, so you can use its search engine to check if you have been a victim of the hack.
The Russian Facebook VK.com is said to be the largest social networking site in Europe with more than 350 million users. So this hack is believed to be the largest the site has ever experienced.
The credentials exposed in the hack are believed to have been stolen in late 2012 or early 2013, when VK.com had around 190 million users.
It is also believed that all of the data breaches from LinkedIn, MySpace, and Tumblr took place during the same period, between 2012 and 2013, when many websites did not have proper web security policies, such as hashing and salting passwords.
The hacker, who goes by the name Peace (or Peace_of_mind), is selling the entire data set – which is over 17 gigabytes in size – on The Real Deal dark web marketplace for just 1 Bitcoin.
According to LeakedSource, the most popular password used by VK.com users was “123456,” followed by “qwerty” and “123123,” which are incredibly easy to guess. Also, the vast majority of email addresses came from mail.ru.
As with other data breaches, we strongly recommend that you change your password immediately, especially if you use the same password for other websites.
Source: Audax Cybersecurity
