• Light/Dark
  • Ever wanted an RSS feed of all your favorite gaming news sites? Go check out our new Gaming Headlines feed! Read more about it here.

617 Million+ account details from data breaches posted for sale on dark web

Reader mode
Axe

Axe

Member
Oct 27, 2017
2,746
United Kingdom
I hadn't seen anything about this, so apologies if old. Received an email from have i been pwned? this morning saying that my details were compromised in a MyFitnessPal breach that occurred last year (143,606,147 accounts affected) and that the data is now up for sale. Upon looking into it further it seems many more sites and apps have been compromised and all of the details are part of this sale too.

The Register — 620 million accounts stolen from 16 hacked websites now for sale on dark web, seller boasts
Exclusive Some 617 million online account details stolen from 16 hacked websites are on sale from today on the dark web, according to the data trove's seller.

For less than $20,000 in Bitcoin, it is claimed, the following pilfered account databases can be purchased from the Dream Market cyber-souk, located in the Tor network:

Dubsmash (162 million), MyFitnessPal (151 million), MyHeritage (92 million), ShareThis (41 million), HauteLook (28 million), Animoto (25 million), EyeEm (22 million), 8fit (20 million), Whitepages (18 million), Fotolog (16 million), 500px (15 million), Armor Games (11 million), BookMate (8 million), CoffeeMeetsBagel (6 million), Artsy (1 million), and DataCamp (700,000).

Sample account records from the multi-gigabyte databases seen by The Register appear to be legit: they consist mainly of account holder names, email addresses, and passwords. These passwords are hashed, or one-way encrypted, and must therefore be cracked before they can be used.

There are a few other bits of information, depending on the site, such as location, personal details, and social media authentication tokens. There appears to be no payment or bank card details in the sales listings.
Click to expand...
Click to shrink...

Engadget — Stolen user data from MyFitnessPal and other services hits the dark web
Most of the passwords are believed to be encrypted and hashed, meaning any buyer will have to crack the encryption to gain access to the accounts. However, because data breaches have become some common, a purchaser could cross-reference email addresses with previous breaches. If a person has reused a password, their account may be compromised. As a precaution, if you've used any of the affected services, it's probably best to change your password.
Click to expand...
Click to shrink...

Everyone who might be affected should check if their accounts have been compromised.

EDIT: Here's an excellent guide on securing your accounts.
https://www.resetera.com/threads/th...-changing-some-passwords.94070/#post-16957658
 
Last edited:
Red

Red

Member
Oct 26, 2017
11,624
Two of my Gmail accounts were compromised recently, and they both had unique passwords/2FA. I wonder if more reports will come out. I had to change my 500px password back in November because of a breach.
 
Black_Red

Black_Red

Member
Oct 27, 2017
2,929
Damn I had an acount on myfitnesspal and fotolog.

It was an old password, but I dont know if I have used it somewhere else.
 
F34R

F34R

Member
Oct 27, 2017
11,987
Sucks for everyone affected. :(
Luckily, I don't have an account with any of those sites.
 
MagicDoogies

MagicDoogies

Member
Oct 31, 2017
1,047
What's interesting in the article is the statement that some of these sites NEVER told their users about a security breach. Imagine now finding out you were compromised through an article where the data was already bought and about to be used.
 
NekoNeko

NekoNeko

Banned
Oct 26, 2017
18,447
At this point i just assume that everyone who really wants can get into my accounts. I'm making sure that it doesn't matter all that much.
 
Etrian Oddity

Etrian Oddity

Member
Oct 26, 2017
3,429
Great spot OP, thanks. I used MFP back in the day.

MagicDoogies said:
What's interesting in the article is the statement that some of these sites NEVER told their users about a security breach. Imagine now finding out you were compromised through an article where the data was already bought and about to be used.
Click to expand...
Click to shrink...
This is the real horseshit that needs legislation, the negligence in aftermaths.
 
Donos

Donos

Member
Nov 15, 2017
6,518
Dipro said:
At this point i just assume that everyone who really wants can get into my accounts. I'm making sure that it doesn't matter all that much.
Click to expand...
Click to shrink...
Really, just use Lastpass, KeePass or whatever password manager fits you and generate some random big ass passwords for each site. The programs all have mobile aps so you have all passes with you all the time.

Work collegaue has the same password for everything (that something i would not tell out loud btw). I tried to reason with him and told him about breaches but he doesn't care.
 

Deleted member 8118

User requested account closure
Banned
Oct 26, 2017
3,639
A few years ago, I went through all of my old accounts and started erasing them and changing passwords.

It doesn't make sense for many of us to have so many accounts. I haven't even used some in years.
 
NekoNeko

NekoNeko

Banned
Oct 26, 2017
18,447
Donos said:
Really, just use Lastpass, KeePass or whatever password manager fits you and generate some random big ass passwords for each site. The programs all have mobile aps so you have all passes with you all the time.

Work collegaue has the same password for everything (that something i would not tell out loud btw). I tried to reason with him and told him about breaches but he doesn't care.
Click to expand...
Click to shrink...

i do use that for the most important sites but for everything else it's too big of a hassle for me.
 
Donos

Donos

Member
Nov 15, 2017
6,518
Dipro said:
i do use that for the most important sites but for everything else it's too big of a hassle for me.
Click to expand...
Click to shrink...
With the apps on my smartphone (KeePass), it works pretty fast so i don't mind. Breaches are getting more and more so i don't risk it. Only a couple sites i use still have "normal" passwords which i have memorised but they all have 2FA via sms or Google Authenticator and are still unique only for this site.
 

Deleted member 18742

User requested account closure
Banned
Oct 27, 2017
2,834
So I have been "pwned on 1 breached site and found no pastes".

Should I change my passwords or something?
 
How to check if your passwords are compromised
  • Index
    • RexNovis

    RexNovis

    Member
    Oct 25, 2017
    4,151
    To check to see if your passwords were compromised you should use this link

    https://haveibeenpwned.com/Passwords

    Input your password and it will tell you if it has been a part of any leaks. The passwords you input are not stored in any fashion and are searched using a secure hash system so it's relatively safe.

    I would actually suggest using unique passwords of your own making for every account and keeping a physical or stop gapped record of them for reference. The most secure passwords are generally just strings of random words out together to create something like

    TaffyGritSuspenders
    ​
    So just come up with some random words and put them together. I find that the more random and bizarre they are the easier it actually is to remember these passwords. You can then alter it to include numerals or symbols if needed. Only use each password with a single account online. Never use the same words or phrases across multiple passwords and you'll be as secure as you possibly could be.
     
  • Index
    • Robochimp

    Robochimp

    Avenger
    Oct 25, 2017
    2,677
    I've only ever used Facebook login to access MyFitnessPal, while my email address is listed on haveIbeenpwned for this breech, there shouldn't be a password in MyFitnessPal's database right?
     
    RexNovis

    RexNovis

    Member
    Oct 25, 2017
    4,151
    Robochimp said:
    I've only ever used Facebook login to access MyFitnessPal, while my email address is listed on haveIbeenpwned for this breech, there shouldn't be a password in MyFitnessPal's database right?
    Click to expand...
    Click to shrink...
    Uncertain. They may have a hashed record of your Facebook password stored. Try putting your face book password into the pwned password link to make sure. Even if it lists it as not owned I'd reccomend updating it to be safe
     
    Robochimp

    Robochimp

    Avenger
    Oct 25, 2017
    2,677
    RexNovis said:
    Uncertain. They may have a hashed record of your Facebook password stored. Try putting your face book password into the pwned password link to make sure. Even if it lists it as not owned I'd reccomend updating it to be safe
    Click to expand...
    Click to shrink...

    Ok, the password is not pwned, they must just get an authorization token from Facebook.
     
    Robochimp

    Robochimp

    Avenger
    Oct 25, 2017
    2,677
    RexNovis said:
    Good! Like I said I'd change your password just to be safe. Take the opportunity to make a more secure one using the tips I posted above. It might just keep your account safe in the future.
    Click to expand...
    Click to shrink...

    I'm not worried, it's a long complicated one use password created by my iPhone, and I have 2FA on.
     
    Dyno

    Dyno

    The Fallen
    Oct 25, 2017
    13,233
    RexNovis said:
    To check to see if your passwords were compromised you should use this link

    https://haveibeenpwned.com/Passwords

    Input your password and it will tell you if it has been a part of any leaks. The passwords you input are not stored in any fashion and are searched using a secure hash system so it's relatively safe.

    I would actually suggest using unique passwords of your own making for every account and keeping a physical or stop gapped record of them for reference. The most secure passwords are generally just strings of random words out together to create something like

    TaffyGritSuspenders
    ​
    So just come up with some random words and put them together. I find that the more random and bizarre they are the easier it actually is to remember these passwords. You can then alter it to include numerals or symbols if needed. Only use each password with a single account online. Never use the same words or phrases across multiple passwords and you'll be as secure as you possibly could be.
    Click to expand...
    Click to shrink...

    What are the chances that site will also sell your password just for checking it? I've always been super dubious of that site in the first place
     
    TarpitCarnivore

    TarpitCarnivore

    Member
    Oct 25, 2017
    20,203
    RexNovis

    RexNovis

    Member
    Oct 25, 2017
    4,151
    Dyno said:
    What are the chances that site will also sell your password just for checking it? I've always been super dubious of that site in the first place
    Click to expand...
    Click to shrink...
    Not happening. He specifically does not post these in any searchable way to avoid further compromising passwords. His blog post talking about the password search feature goes into detail about how it works and each password is not stored on the site in any way.
     
    Dyno

    Dyno

    The Fallen
    Oct 25, 2017
    13,233
    TarpitCarnivore said:
    Troy is a renowned security researcher who works for Microsoft. He's not selling shit
    Click to expand...
    Click to shrink...

    That's a bit more reassuring. Ive never used their services since Ive always kinda worried about what happens to the data, but a quick check shows my most important passwords are untouched.

    RexNovis said:
    Not happening. He specifically does not post these in any searchable way to avoid further compromising passwords. His blog post talking about the password search feature goes into detail about how it works and each password is not stored on the site in any way.
    Click to expand...
    Click to shrink...

    Ah awesome. I won't feel as worried to check my account with them tbh then. Though having said that with my passwords safe I should be all good I guess anyway.
     
    TarpitCarnivore

    TarpitCarnivore

    Member
    Oct 25, 2017
    20,203
    So MyFitnessPal and 500px had breaches months ago. Are these new or is someone just trying to make a buck off old breaches? Reselling old breaches is not new and these stories should disclose if these are in fact new.

    Edit: Register touches on it but Engadget doesnt
     
    NekoFever

    NekoFever

    Member
    Oct 25, 2017
    4,009
    Dyno said:
    What are the chances that site will also sell your password just for checking it? I've always been super dubious of that site in the first place
    Click to expand...
    Click to shrink...
    The site is legitimate. The owner is a Microsoft regional director and security researcher who lectures all over the world.

    He wrote a detailed blog post about how the checking feature works. IIRC the service only sees the first few characters of the hash of whatever you input, and all the checking is done in your browser on your end.
     
    SpottieO

    SpottieO

    Member
    Oct 25, 2017
    11,600
    Went ahead and changed my old myfitnesspal password. It was from before I had LastPass so it wasn't as secure as all of my other ones.
     

    Deleted member 19003

    User requested account closure
    Banned
    Oct 27, 2017
    3,809
    Red said:
    Two of my Gmail accounts were compromised recently, and they both had unique passwords/2FA. I wonder if more reports will come out. I had to change my 500px password back in November because of a breach.
    Click to expand...
    Click to shrink...
    Wow, so how are they getting thru googles 2fa so easily? Are you using a smartphone confirmation?
     
    FaceHugger

    FaceHugger

    Banned
    Oct 27, 2017
    13,949
    USA
    I have two different services I subscribe to that warn me of data breaches that may affect me (along with possible run of the mill identity theft) - one free for reasons, the other I pay for. Given the frequency with which I receive alerts this is not surprising.
     
    SegFault

    SegFault

    Member
    Oct 25, 2017
    1,939
    20k for all this info? Yea it's probably junk people already have otherwise the asking price would be more exorbitant.

    Still. Change your passwords use two factor use a password manager etc. be vigilant
     
    Mupod

    Mupod

    Member
    Oct 25, 2017
    5,859
    A few weeks ago I finally bit the bullet and set up Lastpass for every site I could think of, instead of just a handful. I've used it at work for years and honestly it was kind of shitty until some recent updates. But it's very good at detecting password fields and password changes these days, I see no reason not to use it now. Certainly outweighs the inconvenience of remembering 80+ passwords, but it's also nice seeing posts about major breaches and being able to get all smug about how secure you are.

    Tommolb said:
    Those advocating password managers please note they are insecure:

    https://bit-tech.net/news/tech/software/researchers-warn-of-serious-password-manager-flaws/1/
    Click to expand...
    Click to shrink...

    The degree of access needed here would mean you're pooched anyways.
     
    Last edited:
    Inugami

    Inugami

    Member
    Oct 25, 2017
    14,995
    This is why I have different email addresses and the one I use most often only gets used on websites I don't care if anything happens to (still 2 factor).

    Shits crazy. Nothing like having your information stolen because you logged into the forums of places like Rust or EA.
     
    Red

    Red

    Member
    Oct 26, 2017
    11,624
    Cas said:
    Wow, so how are they getting thru googles 2fa so easily? Are you using a smartphone confirmation?
    Click to expand...
    Click to shrink...
    I am yes, and I'm not sure how the accounts were compromised. No google services seem to be in this bucket of hacks so it's probably unrelated. But I'm curious about how it happened.
     

    Deleted member 1088

    Banned
    Oct 25, 2017
    5,759
    RexNovis said:
    To check to see if your passwords were compromised you should use this link

    https://haveibeenpwned.com/Passwords

    Input your password and it will tell you if it has been a part of any leaks. The passwords you input are not stored in any fashion and are searched using a secure hash system so it's relatively safe.

    I would actually suggest using unique passwords of your own making for every account and keeping a physical or stop gapped record of them for reference. The most secure passwords are generally just strings of random words out together to create something like

    TaffyGritSuspenders
    ​
    So just come up with some random words and put them together. I find that the more random and bizarre they are the easier it actually is to remember these passwords. You can then alter it to include numerals or symbols if needed. Only use each password with a single account online. Never use the same words or phrases across multiple passwords and you'll be as secure as you possibly could be.
    Click to expand...
    Click to shrink...
    That's not more secure, I can easily crack that with a dictionary attack. Please stop posting false information.

    The point of those passwords is to limit what a brute force attack can do as they check for every combination. Against a rainbow table any password is fucked. Against a dictionary attack, any words in their dictionaries, combinations, letters replaced with numbers or symbols etc, are vulnerable.

    The point is to make separate passwords for each site and accept that they'll likely be cracked eventually, and change it. You saying that password combination is the most secure is incredibly irresponsible and only adds to the danger of leaked information.
     
    Hollywood Duo

    Hollywood Duo

    Member
    Oct 25, 2017
    41,708
    RexNovis said:
    To check to see if your passwords were compromised you should use this link

    https://haveibeenpwned.com/Passwords

    Input your password and it will tell you if it has been a part of any leaks. The passwords you input are not stored in any fashion and are searched using a secure hash system so it's relatively safe.

    I would actually suggest using unique passwords of your own making for every account and keeping a physical or stop gapped record of them for reference. The most secure passwords are generally just strings of random words out together to create something like

    TaffyGritSuspenders
    ​
    So just come up with some random words and put them together. I find that the more random and bizarre they are the easier it actually is to remember these passwords. You can then alter it to include numerals or symbols if needed. Only use each password with a single account online. Never use the same words or phrases across multiple passwords and you'll be as secure as you possibly could be.
    Click to expand...
    Click to shrink...
    No offense to you but I'm not putting my passwords in to some random website.
     
    ConanEd

    ConanEd

    Alt account
    Banned
    Dec 27, 2018
    1,033
    I switch to both LastPass and BitWarden recently and changed most of my passwords. Still evaluating both and can't say which one is better.
     
    Reader mode
    You must log in or register to reply here.