Many news outlets seem to be reporting this story (NY Times article) about Russian hackers allegedly acquiring billions of usernames and passwords.
A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say.
The records, discovered by Hold Security, a firm in Milwaukee, include confidential material gathered from 420,000 websites, including household names, and small Internet sites. Hold Security has a history of uncovering significant hacks, including the theft last year of tens of millions of records from Adobe Systems.
However, the article is very vague, citing "nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable" as the reason for not publishing any names. The article claims that an independent "security expert" has verified the authenticity of the data, but this expert is not identified.
The only source given in the entire article, as far as I can tell, is Alex Holden of Hold Security, a company that, if I'm not mistaken, stands to benefit from people being highly concerned about cyber security. This has led some to question whether the entire incident is a hoax, or even a sly marketing attempt by Hold Security:
Yes, I expect security firms to make money for making the Internet more secure, but I am skeptical of a firm with a financial incentive in creating a panic to be the main source for a story that causes a panic.
Is there any actual evidence to back up this story?
