Many news outlets seem to be reporting this story (NY Times article) about Russian hackers allegedly acquiring billions of usernames and passwords.

A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say.

The records, discovered by Hold Security, a firm in Milwaukee, include confidential material gathered from 420,000 websites, including household names, and small Internet sites. Hold Security has a history of uncovering significant hacks, including the theft last year of tens of millions of records from Adobe Systems.

However, the article is very vague, citing "nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable" as the reason for not publishing any names. The article claims that an independent "security expert" has verified the authenticity of the data, but this expert is not identified.

The only source given in the entire article, as far as I can tell, is Alex Holden of Hold Security, a company that, if I'm not mistaken, stands to benefit from people being highly concerned about cyber security. This has led some to question whether the entire incident is a hoax, or even a sly marketing attempt by Hold Security:

Yes, I expect security firms to make money for making the Internet more secure, but I am skeptical of a firm with a financial incentive in creating a panic to be the main source for a story that causes a panic.

(by Forbes' Kashmir Hill)

Is there any actual evidence to back up this story?

  • 2
    Given that no one here is likely to get access to the original data, what would you regard as actual evidence to back up the story? – P_S Aug 11 '14 at 7:12
  • @P_S: Fair point. I suppose evidence in support of it being a hoax would also suffice. – Stephan Aug 11 '14 at 9:04
  • 3
    What would you regard as actual evidence in support of it being a hoax? Note: a picture of the couch in his office should Not be included in that category. – Spork Aug 11 '14 at 9:28
  • 1
    @Ladadadada It should be noted that Brian Krebs has a financial stake in the matter so he isn’t impartial. – Konrad Rudolph Aug 12 '14 at 8:49
  • 1
    @KonradRudolph My purpose in stating that he has seen the data and asserts that it is real is to match him to the unnamed security expert who "verified the authenticity of the data". Krebs's assertion that the data is real does not make strong evidence that the data is actually real. He states in that article that he does not have a financial stake in this matter or Hold Security, do you have evidence that he is lying about that? – Ladadadada Aug 12 '14 at 10:55

You must log in to answer this question.

Browse other questions tagged .