Firm That Exposed Breach Of ‘Billion Passwords’ Quickly Offered $120 Service To Find Out If You’re Affected

The company that unveiled the massive billion password hack, now offers a service, costing $120, to detect if your account has been impacted. The explosive report from the New York Times, asserting that a “Russian gang has amassed over a billion passwords,” caused quite a stir as it presented astonishing figures such as “1.2 billion username and password combinations” and “more than 500 million email addresses” falling into the hands of a group of young Russian hackers. Despite the alarming news, the report lacked detail around the condition of the leaked passwords, leading to widespread internet panic.

Given the absence of substantial information regarding the exact email addresses affected or the specific sites compromised, it aroused an environment of digital paranoia. Alex Holden, from Milwaukee-based Hold Security, who provided the information to the NYT, claimed the hackers acquired the passwords through botnets and SQL injections, yet no affected victims were named due to nondisclosure agreements and continued vulnerability of several sites.

This vast security breach understandably triggers concern as individuals are unaware of the specific affected sites and therefore unable to change their passwords as a precautionary measure. The lack of precise details, coupled with the hyped panic, conveniently sets the stage for Hold Security to offer a solution: Pay a mere $120 monthly for their new breach notification service and stay informed about your site’s status concerning the breach.

The firm asserted a promised commitment to continuous monitoring and verification if your company has been victimized by the recent CyberVor breach. However, shortly after their breach notification service drew the attention of a Wall Street Journal reporter, the firm modified the description of their service to a vague “coming soon” message. Finally, Holden confirmed via email that the actual service price will be $10/month or $120/year.

This incident brings to the fore the delicate balance security firms must maintain. The portrayal of a cybersecurity situation as dire can be financially advantageous, thus creating a scenario where panic is not only caused but is also beneficial. Therefore, it’s of utmost importance for readers to approach such reports with a healthy dose of skepticism.

Minor enhancements were applied in 2025 for readability.