Q&A on the Reported Theft of 1.2B Email Accounts
Summary: Security consultancy Hold Security reported that a Russian gang stole more than a billion email account credentials, and Krebs writes that he has seen the researcher's data firsthand and considers it real. The credentials are gathered mainly through SQL injection and by abusing stolen credentials to steal more from victim organizations, then used to send spam in bulk and from compromised Gmail, Yahoo and Outlook accounts to their contacts.
Bottom line: Anyone who reuses an email password elsewhere is exposed: if that other site is breached, crooks can plunder the inbox and spam friends and family to spread malware - so a single reused password can turn one breach into many.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026