Billions of logins stolen in multiple data hacks over time now leaked in massive breach | DW News

Key Concepts:

• Data breach compilation
• Compromised credentials
• Info-stealer malware
• Two-factor authentication (2FA)
• Authenticator code
• Passkeys
• "Have I Been Pwned" service

Data Breach Compilation and Impact

• A security firm, Cyber News, reported a compilation of approximately 16 billion hacked credentials affecting accounts on platforms like Google, Apple, and Facebook.
• Ryan Calmber, a cybersecurity expert, clarifies that this isn't a new data breach but a compilation of past breaches over a long period.
• The large number of credentials indicates the success of "info-stealer" malware, which can steal hundreds of credentials at once.

User Actions and Mitigation

• Users are advised to check if their credentials have appeared in past breaches using services like "Have I Been Pwned" (pwned, p-w-n-e-d).
• It's likely that passwords have been changed and two-factor authentication (2FA) has been added over the time span of the breaches.
• Using an authenticator code or, even better, a passkey is recommended for 2FA.
• Attackers have so many compromised accounts that their main challenge is monetizing them, rather than gaining access.
• Many of the compiled credentials are old and may no longer be valid, especially if 2FA is enabled.

How Breaches Happen

• The credentials were likely stolen from individuals and compromised websites.
• A single malware infection on a person's browser can compromise hundreds of credentials at once.

Company Efforts and Future Security

• Companies like Facebook, Apple, and Google are taking steps to reduce the relevance of password-based breaches.
• Microsoft now allows creating accounts without passwords, using passkeys instead.
• Apple and Google are also working to eliminate passwords, but old passwords may still be active and pose a risk if not connected to a second factor.

Conclusion

While the large number of compromised credentials is concerning, the compilation consists of older breaches. Users should check if their credentials have been exposed, use strong passwords, and enable two-factor authentication with authenticator codes or passkeys. Companies are also working to eliminate passwords and improve security.