A cybersecurity firm said it has uncovered about 1.2 billion Internet logins and passwords and more than 500 million email addresses amassed by a Russian crime ring, the largest known collection of such stolen data, the New York Times reported on Tuesday, according to The Associated Press.
Hold Security of Milwaukee, Wisconsin, which discovered the credentials, said they were stolen from some 420,000 websites, according to the report, the AP reported.
The thievery was described in a Times story based on the findings of Hold Security, a Milwaukee firm that has a history of uncovering online security breaches, according to the AP.
Hold Security declined to identify the sites that were breached, citing nondisclosure agreements and concerns that they remained vulnerable to attack, the paper reported on its website, according to the AP.
"Hackers did not just target U.S. companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites. And most of these sites are still vulnerable," the Times quoted Alex Holden, the founder of Hold Security, as saying, the AP reported.
Dmitri Alperovitch, chief technology officer of the cybersecurity firm CrowdStrike told Reuters that the stolen passwords could be used to access other accounts beyond the ones on sites that were breached because people commonly use the same passwords for multiple sites, according to the AP.
"A compromise like this could mushroom," said Alperovitch, the AP reported. The reported break-ins are the latest incidents to raise doubts about the security measures that both big and small companies use to protect people's information online.
Security experts believe hackers will continue breaking into computer networks unless companies become more vigilant, according to the AP.
"Companies that rely on usernames and passwords have to develop a sense of urgency about changing this," Avivah Litan, a security analyst at the research firm Gartner told the Times, the AP reported.
