Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Protection

Hackers Steal 25 Million Accounts From Mail.Ru Domains

Hackers have managed to steal millions of user accounts from several Mail.Ru domains, but the Russian Internet company says the compromised credentials are invalid and assured customers that they are not at risk.

Hackers have managed to steal millions of user accounts from several Mail.Ru domains, but the Russian Internet company says the compromised credentials are invalid and assured customers that they are not at risk.

LeakedSource, a service that allows users and businesses to check if their online accounts have been compromised, reported on Wednesday that cybercriminals obtained roughly 25 million username and password combinations from three different domains: cifre.mail.ru, parapa.mail.ru and tanks.mail.ru. The affected domains host forums for games acquired by the Mail.Ru Group over the past years.

The passwords were stored as MD5 hashes with and without salts, which has allowed LeakedSource to easily crack millions of them. The most common passwords appear to be 123456789, 12345678, 123456 and 1234567890.

While this might sound like a serious breach, Mail.Ru says the leaked passwords are no longer valid and its forums now use a different authorization system. The company also pointed out that the compromised passwords were never associated with Mail.Ru email accounts or other services.

Nevertheless, the many password reuse attacks detected recently by companies such as Facebook, GitHub, Reddit and Netflix show that even older credentials can be useful for malicious actors.

The Mail.Ru forums were reportedly breached in August after attackers exploited a vulnerability in the vBulletin forum software. vBulletin flaws have been leveraged over the past few weeks to breach numerous websites, including Epic Games and Dota 2 forums.

In May, Hold Security reported identifying 272 million email credentials obtained by cybercriminals after breaching the systems of several companies. Researchers discovered that 57 million of the credentials were for Mail.ru accounts, but the Internet company later determined that 99 percent of the usernames and passwords were invalid.

LeakedSource says it has collected more than 2 billion leaked records to date, and it claims to possess more data that has yet to be added to its databases. In comparison, the Have I Been Pwned service operated by security expert Troy Hunt has more than 1.3 billion accounts collected from 125 breached websites.

Advertisement. Scroll to continue reading.

Over the past months, LeakedSource disclosed several breaches, including ones impacting SocialBlade (300,000 accounts), VerticalScope (45 million), VK (100 million), Myspace (360 million) and Tumblr (65 million).

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Compliance

The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Data Protection

While quantum-based attacks are still in the future, organizations must think about how to defend data in transit when encryption no longer works.

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Cybersecurity Funding

Los Gatos, Calif-based data protection and privacy firm Titaniam has raised $6 million seed funding from Refinery Ventures, with participation from Fusion Fund, Shasta...