`Data Hacker’s steal `Three Hundred and Sixty Million Account Credentials’ now on `Black Market’

#AceSecurityNews says one of the largest single personal data hack’s ever? 360 million stolen account credentials found on-line.

Published time: March 01, 2014 01:31
 
Reuters / Kacper PempelReuters / Kacper Pempel
A cyber security firm has reported a “mind boggling” cache of stolen credentials which has been put up for sale on online black markets.
A total of 360 million accounts were affected in a series of hacks, one of which seems to be the biggest in history.

Alex Holden, chief information security officer of Hold Security LLC, said that the firm had uncovered the data over the past three weeks.

He said that 360 million personal account records were obtained in separate attacks, but one single attack seems to have obtained some 105 million records which could make it the biggest single data breach to date, Reuters reports. “The sheer volume is overwhelming,” said Holden in a statement on Tuesday. 

“These mind boggling figures are not meant to scare you and they are a product of multiple breaches which we are independently investigating. This is a call to action,” he added. 

Hold Security said that as well as 360 million credentials, hackers were also selling 1.25 billion email addresses, which may be of interest to spammers. 

The huge treasure trove of personal details includes user names, which are most often email addresses, and passwords, which in most cases are unencrypted. 

Hold Security uncovered a similar breach in October last year, but the tens of millions of records had encrypted passwords, which made them much more difficult for hackers to use. 

“In October 2013, Hold Security identified the biggest ever public disclosure of 153 million stolen credentials from Adobe Systems Inc. One month later we identified another large breach of 42 million credentials from Cupid Media,”
 Hold Security said in statement.

AFP Photo / Justin SullivanAFP Photo / Justin Sullivan

Holden said he believes that in many cases the latest theft has yet to be publically reported and that the companies that have been attacked are unaware of it. He added that he will notify the companies concerned as soon as his staff has identified them. 

“We have staff working around the clock to identify the victims,”
 he said. 

However, he did say that the email addresses in question are from major providers such as AOL Inc, Google Inc, Yahoo Inc, and Microsoft Corp, as well as “almost all” Fortune 500 companies and nonprofit organizations.

Heather Bearfield, who runs cybersecurity for an accounting firm Marcum LLP, told Reuters that while she had no information about Hold Security’s findings, she believed that it was quite plausible as hackers can do more with stolen credentials than they can with stolen credit cards, as people often use the same login and password for many different accounts. 

“They can get access to your actual bank account. That is huge. That is not necessarily recoverable funds,” she said. 

The latest revelation by Hold Security comes just months after the US retailer Target announced that 110 million of their customers had their data stolen by hackers. Target and the credit and debit card companies concerned said that consumers do not bear much risk as funds are rapidly refunded in fraud losses.

RT  

 

Enhanced by Zemanta

#acesecuritynews, #adobe-systems, #aol, #cupid-media, #fortune-500, #google, #information-technology, #microsoft, #reuters, #yahoo

Giant US government Internet spying scandal revealed!

The Washington Post and The Guardian have revealed a US government mass Internet surveillance program code-named “PRISM”. They report that the NSA and the FBI have been tapping directly into the servers of nine US service providers, including Facebook, Microsoft, Google, Apple, Yahoo, YouTube, AOL and Skype, and began this surveillance program at least seven years ago. (Imageclarifying slides)

 

These revelations are shaking up an international debate.

 

Start Page has always been very outspoken when it comes to protecting people’s privacy and civil liberties. So it won’t surprise you that we are a strong opponent of overreaching, unaccountable spy programs like PRISM. In the past, even government surveillance programs that were begun with good intentions have become tools for abuse, for example tracking civil rights and anti-war protesters.

 

Programs like PRISM undermine our Privacy, disrupt faith in governments, and are a danger to the free Internet.

 

StartPage and its sister search engine Ixquick have in their 14-year history never provided a single byte of user data to the US government, or any other government or agency. Not under PRISM, nor under any other program in the US, nor under any program anywhere in the world. We are not like Yahoo, Facebook, Google, Apple, Skype, or the other US companies who got caught up in the web of PRISM surveillance.

 

Here’s how we are different:

 

  • StartPage does not store any user data. We make this perfectly clear to everyone, including any governmental agencies. We do not record the IP addresses of our users and we don’t use tracking cookies, so there is literally no data about you on our servers to access. Since we don’t even know who our customers are, we can’t share anything with Big Brother. In fact, we’ve never gotten even a single request from a governmental authority to supply user data in the fourteen years we’ve been in business.

  • StartPage uses encryption (HTTPS) by default. Encryption prevents snooping. Your searches are encrypted, so others can’t “tap” the Internet connection to snoop what you’re searching for. This combination of not storing data together with using strong encryption for the connections is key in protecting your Privacy.

  • Our company is based in The Netherlands, Europe. US jurisdiction does not apply to us, at least not directly. Any request or demand from ANY government (including the US) to deliver user data, will be thoroughly checked by our lawyers, and we will not comply unless the law which actually applies to us would undeniably require it from us. And even in that hypothetical situation, we refer to our first point; we don’t even have any user data to give. We will never cooperate with voluntary spying programs like PRISM.

  • StartPage cannot be forced to start spying. Given the strong protection of the Right to Privacy in Europe , European governments cannot just start forcing service providers like us to implement a blanket spying program on their users. And if that ever changed, we would fight this to the end.

 

Privacy.

 

It’s not just our policy – it’s our business.
~~~~~~~~~~~~~~~

Courtesy of

Robert E.G. Beens
CEO StartPage.com and Ixquick.com

#aol, #facebook, #fbi, #google, #guardian, #ixquick, #nsa, #prism, #privacy, #search-engines, #security, #skpe, #social-media, #startpage, #twitter, #washigton-post, #yahoo, #youtube