Password hack affects 1.2 billion accounts, more at risk

Russian hackers have stolen 1.2 billion user names and passwords in a series of internet heists affecting 420,000 websites, according to a Milwaukee firm that specializes in uncovering online security breaches.

Hold Security CEO Alex Holden said more accounts could be compromised if the hackers sell the information they have gathered.

• Passwords: 7 ways to make them stronger

• StubHub cybercrime attack leads to 10 arrests

If it gets into another's hands on this black market these people can use the credentials to get into any account that had been compromised. And because people reuse their passwords, in many cases these credentials may lead to other information, including very private personal data, Holden said.

Right now, its known the information is being used to send marketing pitches, schemes and other junk messages on social networks such as Twitter.

Holden did not reveal the identities of the websites that were broken into, but said none were major email providers.

Small group of hackers

He said it took his company seven months to uncover one criminal gang responsible for the hacking, a gang of 10 or 11 hackers he has dubbed CyberVor. Vor is Russian for thieves.

My company, Hold Security, works on monitoring the cybercriminal underground and trying to recover some of our clients' stolen data and also warn our clients before something bad happens to them, before the data goes missing. In the course of this investigation that took seven months, we were able to research this particular gang and find this staggering discovery, he said.

But he said he is uncertain that Russian authorities will move against the criminals, as there is no history of Russia controlling cybercrime. That gives criminal gangs the freedom to threaten cybersecurity around the world.

They feel crimes will go unpunished because there is no extradition between Russia and U.S. that I'm aware of. These people, as long as they dont attack their own, will be able to get away with stealing anything they want from America, Europe, or other countries, Holden said.

The Russian hackers had been collecting databases of personal information for years, Holden said, but in April the group began deploying a new online attack technique that quickly shot from computer system to computer system as unwitting infected users visited random websites.

Holden said he had not heard from any law enforcement agencies, but he hopes investigators do contact him and added that his firm would be happy to co-operate.

Weaknesses in protecting information

The reported break-ins are the latest incidents to raise doubts about the security measures that both big and small companies use to protect people's information online.

Security experts believe hackers will continue breaking into computer networks unless companies become more vigilant.

"Companies that rely on usernames and passwords have to develop a sense of urgency about changing this," Avivah Litan, a security analyst at the research firm Gartner told the New York Times, which first covered the story.

Retailer Target Corp. is still struggling to win back thetrust of shoppers after hackers believed to be attacking from Eastern Europe stole 40 million credit card numbers and 70 million addresses, phone numbers and other personal information last winter.

Tim Stevens, editor of CNet, advises people to change their passwords to avoid being a target of scammers.

There will be a site set up in the future that will let you log in to see if your user accounts have been exposed, but we dont know when that is going to be appearing, and in the interim you dont want that information hanging out there, so you should change every password youve got, he said.

With every website on the internet managing its own security, there are bound to be vulnerabilities, Stevens said. He advocates finding a more secure way of logging in, possibly using biometrics.

The breadth of these break-ins should serve as a chilling reminder of the skulduggery that has been going undetected on the internet for years, said John Prisco, CEO of another security firm, Triumfant.

"This issue reminds me of an iceberg, where 90 per cent of it is actually underwater," Prisco said in an emailed statement. "That's what is going on here... So many cyber breaches today are not actually reported, oftentimes because companies are losing information and they are not even aware of it."