[BreachExchange] RockYou2021: largest password compilation of all time leaked online with 8.4 billion entries

[Sophia Kingsbury]

https://cybernews.com/security/rockyou2021-alltime-largest-password-compilation-leaked/

What seems to be the largest password collection of all time has been
leaked on a popular hacker forum. A forum user posted a massive 100GB TXT
file that contains 8.4 billion entries of passwords, which have presumably
been combined from previous data leaks and breaches.

According to the post author, all passwords included in the leak are 6-20
characters long, with non-ASCII characters and white spaces removed. The
same user also claims that the compilation contains 82 billion passwords.
However, after running our own tests, the actual number turned out to be
nearly ten times lower – at 8,459,060,239 unique entries.

The compilation itself has been dubbed ‘RockYou2021’ by the forum user,
presumably in reference to the infamous RockYou data breach that occurred
in 2009, when threat actors hacked their way into the social app website’s
servers and got their hands on more than 32 million user passwords stored
in plain text.

With a collection that exceeds its 12-year-old namesake by more than 262
times, this leak is comparable to the Compilation of Many Breaches (COMB),
the largest data breach compilation ever. Its 3.2 billion leaked passwords,
along with passwords from multiple other leaked databases, are included in
the RockYou2021 compilation that has been amassed by the person behind this
collection over several years.

Considering the fact that only about 4.7 billion people are online,
numbers-wise the RockYou2021 compilation potentially includes the passwords
of the entire global online population almost two times over. For that
reason, users are recommended to immediately check if their passwords were
included in the leak.

To check whether your password is part of this gigantic leak, head over to
the CyberNews personal data leak checker or our leaked password checker,
where we are currently uploading the password entries from the RockYou2021
compilation.

If you can’t find your password in our leak databases at the moment, make
sure to check back tomorrow, which is when the compilation is expected to
be transferred in its entirety.

Potential impact

By combining 8.4 billion unique password variations with other breach
compilations that include usernames and email addresses, threat actors can
use the RockYou2021 collection to mount password dictionaries and password
spraying attacks against untold numbers of online accounts.

Since most people reuse their passwords across multiple apps and websites,
the number of accounts affected by credential stuffing and password
spraying attacks in the wake of this leak can potentially reach millions,
if not billions.

What to do if your password was leaked?

If you suspect that one or more of your passwords may have been included in
the RockIt2021 collection, we recommend taking the following steps in order
to secure your data and avoid potential harm from threat actors:


   - Use our personal data leak checker and leaked password checker to see
   if your data has been leaked in this or other breaches.
   - If your data has been compromised, make sure to change your passwords
   across your online accounts. You can easily generate complex passwords with
   our strong password generator or consider using a password manager.
   - Enable two-factor authentication (2FA) on all of your online accounts.
   - Watch out for incoming spam emails, unsolicited texts, and phishing
   messages. Don’t click on anything that seems suspicious, including emails
   and texts from senders you don’t recognize.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20210607/5e3aeb36/attachment.html>