Collection #1 Data Breach, What you Need to Know

  • By David Lukic
  • Jan 13, 2021

Almost a year ago, in January of 2019, news of data breach broke about Collection #1. You may or may not have heard of it. What made Collection #1 data breach unique is the sheer magnitude and weight of it. Troy Hunt, security researcher and owner of the site “Have I Been Pwned?” found the treasure trove of data and reported it to the world.

The data was initially found on a cloud server called MEGA in a popular hacker forum and was later posted on the dark web for all to see. The file was over 87 GB large, with more than 12,000 files. It contained more than 2.7 billion rows of information from more than 2000 data breaches and included email addresses, usernames, and decrypted passwords for more than a billion people. Mr. Hunt uploaded all the passwords to his server so that owners of the accounts could check to see if their data was included. Collection #1 is the largest-ever compilation of hacked, stolen data to date. The number of unique email addresses in the list total 772,904,991. Additionally, there are 21,222,975 unique passwords.

collection #1 data breach

Should You Be Concerned About Collection #1 Data Breach?

Although the data showed millions of plain text passwords that had been decoded, many of them were from old, stale accounts and unusable to any criminals. The package was being offered on the dark web at no cost, which also begs the question of value. Additionally, since the passwords were in plain text, they won’t work in sites that add salting or hashing to the password. Only a very skilled hacker would be able to use the data efficiently.

Security experts assume that the intention was to use the data for credential stuffing. However, other uses for stale data are phishing campaigns and ransomware, extortion, and other techniques to scare people by sharing some information and tricking them into thinking you have more.

Upon learning of the incident, Brian Krebs of KrebsOnSecurity contacted a party selling the list and found out there were seven more identical lists totaling more than 500 GB of data. Since then, security researchers have seen Collections #2, #3, #4, and #5 surface for sale on the dark web and they had five times the amount of information that Collect # 1 had. Some of the data contained within them were from the Yahoo, LinkedIn, and Dropbox data breaches.

What is Credential Stuffing

If your logins were included in the Collection #1 data breach, you will want to know what credential stuffing is. It’s when hackers take a list of potential username/password combinations and use sophisticated software they throw them against hundreds of websites to see if they can get in. These combinations worked somewhere, at one time, so they are hoping they are still active at least somewhere. Your best defense against credential stuffing is changing your passwords often and never using the same ones on different sites.

collection #1

What You Can Do to Protect Yourself  from Collection #1 Data Breach

At this point, most Americans have been affected by at least one of the data breaches that have taken place in recent history. Many of us have been hit multiple times. So, what can you do to stay safe?

  • If you are included in this latest data breach, visit Have I Been Pwned? to see if you're listed in pwned passwords. You can also run your most secure passwords through the site and see if they show up anywhere on the dark web also. 
  • Change all your login passwords on every site immediately.
  • Use only strong, long passwords that use a combination of letters (both capitalized and lowercase) numbers and symbols. 
  • Never use the same passwords on multiple sites.
  • Consider using a password vault and generator to create long, complex passwords for you and store them, so you don’t have to remember each one.
  • Watch out for phishing attempts or scam emails.
  • Never click links or download attachments in emails. 
  • Never download software from an untrusted vendor and stay away from insecure websites. 
  • Install antivirus software with ransomware protection. Run deep scans often. 
  • Keep all your devices updated with the latest operating system and security patches. 
  • Enable two-factor authentication on all your accounts, whenever available.

Although no credit card or banking information was included in this massive data breach, criminals do have all they need to wage pretty successful phishing campaigns and possibly other methods towards identity theft. Follow the tips above and use common sense to stay safe.

About the Author
IDStrong Logo

Related Articles

What is Data Leak and How to Prevent Accidental Data Leakage

Data breaches take many forms, and one of them is through data leak and accidental web exposure. M ... Read More

The Saga of T-Mobile Data Breach: 2013, 2015, 2021 and 2023 Hacks

T-Mobile has experienced a number of data breaches in the past decade. The first case occurred som ... Read More

Anthem Data Breach Exposed 78 Million Records

In the Anthem Data Breach of 2015, hackers were able to steal 78.8 million member’s records. ... Read More

Everything You Need to Know About Insider Data Breach

Data breaches are on the news frequently, but the average person doesn’t really know that mu ... Read More

The NSA Hack, How Did it Happen?

The National Security Agency (NSA) was the main attraction in a major data breach involving three ... Read More

Latest Articles

Health Organization Records Stolen via Welltok’s MOVEit - 930k+ Including Minors

Health Organization Records Stolen via Welltok’s MOVEit - 930k+ Including Minors

The number of victims caused by the global MOVEit data breach continues to climb; Welltok has announced more exposures, this time from three more health organizations.

MOVEit Breach Creates More Victims; 105k Records Stolen from Insurance Group

MOVEit Breach Creates More Victims; 105k Records Stolen from Insurance Group

"Pan American Life Insurance Group Building - New Orleans" by Tony Webster is licensed under CC BY 2.0. Source: Flickr

New York Healthcare Provider Notified 600k Following Network Cyberattack

New York Healthcare Provider Notified 600k Following Network Cyberattack

East River Medical Imaging (ERMI) has three locations in New York City and Westchester County.  ERMI is a "multi-modality radiology center," including patient-centered solutions like MRIs, CTs, ultrasounds, imaging, radiology, fluoroscopy, and x-rays.

Featured Articles

How to Buy a House with Bad Credit

How to Buy a House with Bad Credit

Buying your own home is the American Dream, but it might seem out of reach to those with bad credit. However, the good news is, if your credit is less than perfect, you do still have options and in most cases, can still buy a home.

How Secure Is Your Password? Tips to Improve Your Password Security

How Secure Is Your Password? Tips to Improve Your Password Security

Any good IT article on computers and network security will address the importance of strong, secure passwords. However, the challenge of good passwords is that most people have a hard time remembering them, so they use simple or obvious ones that pose a security risk.

Top 10 Senior Scams and How to Prevent Them

Top 10 Senior Scams and How to Prevent Them

Senior scams are becoming a major epidemic for two reasons. First, seniors often have a lot of money in the bank from a life of working hard and saving.

Free Identity Threat Scan
Instantly Check if Your Personal Information is Exposed
All fields below are required
Please enter first name
Please enter last name
Please enter a city
Please select a state
Please enter an age
Please enter an email address