What appears to be the largest password collection of all time has leaked on a popular hacking forum. A forum user posted a massive 100 GB TXT file that contains 8.4 billion password entries, which were likely gathered from previous data leaks and breaches.
See also: FBI will check compromised passwords on Have I Been Pwned
According to the author of the post, all passwords included in the leak are 6-20 characters long (without ASCII characters and spaces). The same user also claims that the collection contains 82 billion passwords. However, after running our own tests, the actual number proved to be almost ten times lower – at 8,459,060,239 unique entries.
See also: Google Chrome: Automatically fixes compromised passwords on Android
The collection itself was named «RockYou2021» by the forum user, possibly because of the infamous RockYou data breach that occurred in 2009, when hackers invaded the servers of the social app's website and seized most of the 32 million passwords.
Taking into account the fact that only about 4.7 billion people are connected to the Internet, the numeric collection of RockYou2021 likely includes the passwords of the entire global online population almost twice. For this reason, users are advised to immediately check whether their passwords were included in the breach.
To check if your password is part of this giant leak, go to CyberNews' privacy leak checker or the password checker , where password entries from the RockYou2021 collection have been uploaded.
See also: Hackers target Passwordstate users with new malware
Possible impacts
Combining 8.4 billion unique password variations with other breach collections that include usernames and email addresses, threat actors can use the RockYou2021 collection to launch password dictionary and password spraying attacks against many online accounts.
Given that most people reuse their passwords across many applications and websites, the number of accounts affected by credential stuffing and password spraying attacks after this breach can potentially reach millions, if not billions.
What should you do if your password has been leaked?
If you suspect that one or more of your passwords may have been included in the RockYou2021 collection, we recommend that you follow the steps below to secure your data and avoid possible damage from threatening actors:
- Use the links attached above to see if your data has been leaked.
- If your data has been compromised, make sure to change the passwords on your online accounts. Create complex passwords.
- Enable two-factor authentication (2FA) on all your online accounts.
- Watch out for incoming spam emails and phishing messages. Do not click on anything that looks suspicious.
Information source: cybernews.com
