Billions of Passwords Offered for $2 in Cyber-Underground

A post on the English-language cybercriminal forum RaidForums has leaked about 3.27 billion stolen user credentials comprising cleartext email addresses and passwords, Threatpost reports. The post was made by user Singularity0x01 and was titled “Compilation of Many Breaches (COMB) 3.8Billion (Public),” according to Digital Shadows cyberthreat intelligence analyst Ivan Righi. Dustin Warren, a researcher at SpyCloud, said that a check of the data revealed most of it had already been accessible on the Dark Web for some time, and appears to include parts of information leaked in previous collections from 2016 and 2019, with some modifications for ease of use. However, threat actors may still use those old credentials to mount brute-force or credential-stuffing attacks, Warren notes. The leak was not received positively because of its poor quality and corruption of some files, and Singularity0x01 took a negative hit in popularity before being banned from the forums for “leaking hidden content,” Righi reports.