Russian Gang have stolen over a billion passwords from internet users

A Russian cybercriminal group has reportedly gathered the largest known cache of stolen internet credentials, a whopping 1.2 billion username and password combinations along with over 500 million email addresses, according to security researchers.

This considerable digital theft was uncovered by Hold Security, a Milwaukee-based firm known for uncovering significant cyber-attacks, including the Adobe Systems data breach last year that resulted in tens of millions of records stolen.

Confidential data collected from around 420,000 websites, including prominent names and smaller internet sites, make up the stolen data archive. Hold Security, due to nondisclosure agreements and a lack of willingness to reveal companies still at risk, has refrained from providing a list of victims.

Alex Holden, founder and chief information security officer of Hold Security, stated that the cybercriminals targeted a broad range of websites, from Fortune 500 companies to miniscule ones. Unfortunately, it appears that a significant number of these sites remain at risk.

Facing an increasingly difficult battle to keep personal information out of cybercriminals’ hands, the security community harbors growing concerns. For instance, cyber-thieves from Eastern Europe stole 40 million credit card numbers and 70 million sets of personal data from retail giant Target in December.

This discovery by Hold Security surpasses previous incidents in sheer size, prompting a rallying call among security experts for enhanced web identity protection. As firms continue relying on usernames and passwords, security analyst Avivah Litan from Gartner research firm encouraged the urgent need for change.

Interestingly, the criminals, so far, have not sold many of the stolen records online. Instead, their approach seems to use the stolen data to send spam on social media platforms like Twitter, performing these tasks for other groups and collecting fees in return.

Stealing personal credentials like email addresses, Social Security numbers, or passwords is particularly dangerous as they can lead to identity theft. With many people using the same passwords across different websites, criminals can potentially utilize stolen data to gain access to valuable information from banks and brokerage firms.

Hold Security, like other computer security consultation firms, maintains contacts within the criminal hacking community and has been tracking this specific group for a while.

This article was updated in 2025 to reflect current trends and insights.