5 ms·

Data leak contains 26B records from numerous previous breaches

210 points by el_duderino 3y ago

mangoo84 3y ago
[dead]
Sai_ 3y ago
Clicking on the posted link seems to send the malwarebytes website server into a reload loop.
jacquesm 3y ago
Suggested link change: https://cybernews.com/security/billions-passwords-credentials-leaked-mother-of-all-breaches/ https://cybernews.com/security/billions-passwords-credential... The other is just a way for malwarebytes to get some clicks and contains very little information.
- dang 3y ago
  Ok, changed to that from https://www.malwarebytes.com/blog/news/2024/01/the-mother-of-all-breaches-26-billion-records-found-online https://www.malwarebytes.com/blog/news/2024/01/the-mother-of... above. Thanks!
hdlothia 3y ago
I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statements and hope for the best.
- SketchySeaBeast 3y ago
  It exhausting. It's a sense of continual doom.
- Aardwolf 3y ago
  With email addresses you can use multiple to not be too affected. But phone numbers are less replaceable than email addresses... And what's annoying is that more and more things now also require phone numbers (like, seriously, in the past an email address was enough but today the simplest thing you want to signup for uses some third party booking platform (which means yet one more party that gets to leak your data) that wants your phone number; even a railway company can't manage its own login anymore. In the mid 2000's I would have thought phone numbers would die and internet would become the new way to communicate but nope, they suddenly became more important instead)
  - lencastre 3y ago
    The simplest thing require full name, address, birthdate, age, yes age, mobile phone, fiscal number, last four digits of the credit card, expiration date of credit card, yomama’s maiden name, the middle 8 digits of your credit, your last used password, your pet’s name, the name of the high school you attended, favorite football team, a front and side pictures no smile no hats no glasses, hi resolution scan of government issued ID, and lastly the first four digits. That’s about it.
    - Aeolun 3y ago
      Hey! Don’t you have all digits of my CC now?!
- autoexec 3y ago
  I still feel like this is why the penalties for allowing user's data to be leaked should be harsh enough to make it worthwhile for companies take even basic steps to protect other people's data, or even better, to avoid collecting it or keeping it in the first place. Since that hasn't happened yet, I try to avoid handing my data over when I can.
  - stvltvs 3y ago
    Agreed, perhaps requiring companies who handle sensitive data to carry insurance and licensing engineers who build those systems, something like the PE.
    - doubled112 3y ago
      > licensing engineers who build those systems The IT and software industries would really change. Perhaps for the better, but perhaps not.
      - HeatrayEnjoyer 3y ago
        I can't possibly see it becoming worse. This isn't the 90s any more, computing and the internet are no longer cute novelties but infrastructure just as critical as electricity or airport communication. Software "engineering" has been due for the professional licensure and direct liability that every other serious industry has had for a century.
- basch 3y ago
  It’s time for attorney generals to hold permanent identity monitoring pots and funds. The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years. If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to run with lower margins if they stay secure. As companies die out, the remaining breaches ones are responsible to keep footing the bill.
  - stvltvs 3y ago
    It should all be free, like getting credit reports is now. We need a robust and accessible way to manage our data personas, assuming that all of the supposed secrets are in fact public data.
    - kingforaday 3y ago
      As a reminder for any US Citizens, there is an official path to getting this from each of the main three for free[1] is the approved method verified by FTC [2]. 1. https://annualcreditreport.com https://annualcreditreport.com 2. https://consumer.ftc.gov/articles/free-credit-reports https://consumer.ftc.gov/articles/free-credit-reports
      - kmoser 3y ago
        This still puts the burden on the consumer of having to verify that their credit file is accurate, not to mention the even bigger burden of trying to correct it.
        Rewrap3643 3y ago
        Furthermore it's a reactive measure. Locking credit reports and unlocking as needed can help mitigate some risks.
  - kelseyfrog 3y ago
    It also incentivizes holding as little personal data as possible and increases the probability of coordinated adoption of systems[1][2][3][4][5] of identification/verification that minimize collateral damage. 1. https://sovrin.org/ https://sovrin.org/ 2. https://github.com/sertoID/ https://github.com/sertoID/ 3. https://www.hyperledger.org/projects/hyperledger-indy https://www.hyperledger.org/projects/hyperledger-indy 4. https://identity.foundation/ion/ https://identity.foundation/ion/ 5. https://www.civic.com/ https://www.civic.com/
- namaria 3y ago
  I'd say it's an inevitable state of affairs. With networked general computers the amount of leaked information tends to 100% of available information over time. Unless you can design, build and run absolutely safe systems. Cybersecurity is a sham, a bolt on industry extracting rent out of the mobile internet junkies we've become. We want to have an endless stream of entertainment and trivia so bad we've actually built homes with locks that connect to the internet. You'd think a networked lock defeats its purpose.
  - deleted 3y ago
    [deleted]
- barrysteve 3y ago
  Long since resigned. It's impossible to keep a secret on the internet. You can't secure military technology, bank secrets, crypto tokens or prevent piracy. Computers were designed to be open by default. General purpose computing mannufactured across the planet with everybody having a hand in the supply chain has become the betrayal system. Security follows the traditional Mafia protection scheme racket. - Some Romanian hacker leaks data from your web server and sells it. - You pay developers to close the vuln. - You pay cybersecurity a protection fee to prevent it happening again. - It happens again. Developing a real technology that can give secure control back to the owner-operator goes against good business incentives. You can't farm users and share the wealth on a truly secure computing model.
- chankstein38 3y ago
  100% with you. At this point my data has been breached so many times I don't even know what the point of caring is. I don't have privacy anymore. Like you I just have credit monitoring and watch my financial statements and hope for the best. This world sucks.
  - WhackyIdeas 3y ago
    Know what? I heard it was illegal in the UK to give websites fake information. But looking at that list of websites justifies what I have been doing for the past 18 years religiously. When a website asks my age, I give it a fake one. When a shop asks for my debit card details I give it my initials J B and then I will confirm the sms security from my bank when the initials flag 30% of the time. Giving every company real data just means it gets leaked. That list of hacked domain names covers just about everyone. Wow.
    - chankstein38 3y ago
      100% with you. It depends on the site but yeah a lot of my information is fake. I really don't understand why so many websites think they need things like my address or phone number anyway. Good thing I live on 100 YouDontNeedThis Blvd!
- Aeolun 3y ago
  That’s honestly not very surprising when any company that does this has to suffer the consequences of… crickets? No consequences at all. It’s no surprise that patching the holes costs them more. It’s also that all these massive companies are absolutely allergic to any change. Unless legal gets wind of it everything can stay exposed if it means the status quo is maintained.
- godelski 3y ago
  I just went through a call with my credit card company. 4 transfers later the only verification I've been asked is the last 4 of my social, my name, and when I was at the "highest level" of security they took the amazing step to... call me back. All because my credit card, which is travel focused, got flagged because I bought a <$300 plane ticket... They claimed I got an email and text message, which I got neither (I'm sure the email got filtered and same with the text message. Thanks Google. I'm glad you filtered those but not the emails addressed to someone else, "from" a hashed domain, and where the header is passed through 5 relay services -- including several .edus. -____-) You are not alone. It is an __absolute joke__ that my github account is more secure than any banking service I use. How is it that the only 2FA they offer is text message? A method that's been known to be terrible for over a decade now. Where are my OTPs? They give me apps on my phone, why not push verification there? (Vanguard recently started doing this) Why can't I set up hardware keys or public private keypairs? Sure, I get that you still got to service grandma and grandpa, but at least give me something. In today's day and age the two most important services I have are email and banking. The former is impossible to resolve when shit hits the fan and the latter doesn't even implement basic security. Something is very wrong, and I'm not sure it is even about money (unless short term vs long term). Dinky little websites implement better security than most baking services. Clearly the banks could reduce their spending on fraud detection and resolution if they added some basic security. I will note that I had a Capital One account that used the card as a 2FA into the phone app. Was neat, other than Capital One was a whole shitshow on its own. I'm also very surprised at how much spam gets through services like Gmail and Twitter which could be easily detected by Naive Bayes filters. Something is very wrong.
  - kesslern 3y ago
    I can log into chase.com with my password in any case. Banking security is an absolute joke. The interesting part is that if I have to do a 2FA SMS challenge, I am required to re-enter my password. At this point the password checking becomes case sensitive.
    - wlesieutre 3y ago
      "In any case" meaning you can change capitalization and it still works? This doesn't work on my chase.com account.
- instagib 3y ago
  The SEC had a disclosure recently which had an effect on the bitcoin market. They turned off MFA and forgot to re-enable it supposedly as well as it was a sim swap attack. The OPM data breach was bad. So much data on there about the individuals and a few degrees of association away from them. Every security question and answer are there. I had 4 data breaches last year and one so far this year I just posted about today that I have no idea how they got my information (0). Mail was stolen by a petty theft and identity theft ring which called to try to get more out of me a couple years ago. Freezing your credit is the best course of action. I don’t really worry about it much anymore. (0) https://news.ycombinator.com/item?id=39101272 https://news.ycombinator.com/item?id=39101272
- GuB-42 3y ago
  The problem is that as long as there are attackers willing to spend resources, there is no limit to spending money on security, it is adversarial. At some point, security will cost more than what you are securing, and that's when people drop the ball and prefer to deal with the consequences. Same ideas as with bicycles. Thieves now have sufficiently advanced tools that people stop buying the kind locks that could possibly stop them, and instead just assume that left unattended in the outside, their bike will be stolen eventually, and deal with it. For example by not having nice bikes, or by not biking unless there is a safe place for that bike. So yeah, leaks will happen. Unless maybe you get a combination of well designed and enforced security standards, harsh penalties for cybercrime, and international collaboration.
- 1970-01-01 3y ago
  Yes. Corporations really do just lose your info and move on as quietly as possible. You can try to not give real info to anyone that isn't the government.
- harry8 3y ago
  They win as long as deliberately making this decision, probably so, at a level way beyond what the reasonably competent person the field could do by accident never results in a conviction recorded and jail term against the ceo and board. The individuals need to be charged and have there day in court with consequences that go beyond “business expense” Conviction recorded is just that. Who will lobby for it because /you/ don’t count? Too poor to matter to law makers.
- jjav 3y ago
  > I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. They do win, unfortunately because they're right. Why spend much on designing security when the inevitable breach costs nothing other than bad press for a few days and then all is forgotten. The only possible solution is to have significant fines for every data item breached. Ideally I'd ratchet up the fines for each occurrence. First breach should hurt the company financially a bit but not be too disruptive, offering a learning opportunity. Subsequent breaches the fines go up, by the fifth breach or so the fines would wipe away the company entirely, since they clearly didn't learn. Anything short of something like this, companies will never care and leak all your data to the wind every year.
  - queuebert 3y ago
    This would be create an incentive to attack a competing company until you breach it 5x, causing its destruction. Competitors would be attacking each other nonstop. Like 3 check chess, but in Delaware.
    - jjav 3y ago
      I don't have a huge problem with that to be honest. Maybe not fifth breach, but something along those lines. Well-funded attackers and competing nations are already attacking these companies, so adding their competitors to the mix doesn't change a lot.
      - josephg 3y ago
        Yep. And if staying in business means keeping your website secure, well, isn’t that the goal? I think part of the problem is that hacker movies make people think hacking is inevitable. Like you can’t actually protect your site and your data from the average punk on roller skates, so why bother? But that’s not true at all. Gmail has - as far as we know - never been breached by anything short of a nation state attacker. And I’m sure a lot of people have tried. You just need to actually care about security and follow best practices (like doing audits / red team and keep up to date with security patches). But most companies only seem interested in properly investing in security if it’s an existential threat.
- specialist 3y ago
  > Does anyone else feel this way? Since the mid 2000s. I worked very hard trying to figure out how to protect patient data. To do so requires translucent database techniques. Which means encrypting all potential PII data at rest at the field level. Exactly like how passwords are stored, extended to all PII. Which requires globally unique identifiers issued by CAs. Just like RealID. Nothing will improve until people accept this fundamental technical truth. Also, on the policy side, PII needs be be changed from an asset to a liability. And ban data hoarding stuff like targeted ads and relevant search.
- wredue 3y ago
  The easiest thing is to just stop registering for useless garbage.
  - brewtide 3y ago
    Recently both my mortgage company, who bought my mortgage from another company without any say from me in the matter, had a giant leak. You heard about it. I'm hardly alone . Then Comcast/Xfinity, same thing. I have 2 options for internet, now, it seems. Comcast or now starlink. Point is, you can plunk your information into relative bare-minimum of sketchiness -- and you'll still be screwed over.
- SlightlyLeftPad 3y ago
  Probably about 10-12 years ago I almost exclusively used +emails so I could determine with pretty high confidence who had breaches and failed to disclose OR identify companies that had sold my data without disclosure. One of the most recent examples was Robinhood Holdings. +emails only got me so far as 50% of sites don’t properly support the RFC5233 subaddressing standard and it ended up being a massive pain when a sign up page accepts the plus sign, stores an improperly escaped version of that and then you can’t login or never get the verification email. Fast forward to 2021, apple released hide-my-email which I use practically everywhere which forwards to a burner email just in case. Every site gets a unique email, password, two-factor. I’ll never have 0 risk but this limits my exposure so much it lets me sleep at night. I only provide real information if absolutely required by law.
  - geraldhh 3y ago
    yea, glad i didn't hop on the +mail thing. catch-all email domains just work, thou it's a bit of a hassle to configure the sending address depending on the mua (ios mail grr)
  - Semaphor 3y ago
    Same here, only I don’t use an external service and simply use my own domain for unique email addresses.
  - cryptoegorophy 3y ago
    I wish hide my email was released 20 years earlier.
- simonebrunozzi 3y ago
  Same for me. Big fail for regulation and government oversight.
- j-bos 3y ago
  I don't. I grew up where break-ins were not an uncommon occurance, so anything that shares my name, finances and address feels like gross negligence.
- geraldhh 3y ago
  > I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. and it's not like it wasn't forseeable 20/40/60 years ago. thou the question remains what would be the alternative? what really bugs me is the fact that it essentially puts all the 'nothing to hide, have my data' folks in the right because, yea, why bother.
- lofaszvanitt 3y ago
  That's why you register with garbage personal details.
freitzkriesler2 3y ago
I skimmed the article but it wasn't clear to me specifically what was leaked. Do they have clear text usernames and passwords? Are the PW hashed?
huytersd 3y ago
So 3 records for each person on earth. Nice.
- SOVIETIC-BOSS88 3y ago
  Title says billions, not trillions.
  - evan_ 3y ago
    are you counting ants as people?
    - fuzztester 3y ago
      at the rate we are going, soon ants will be counting people.
    - araes 3y ago
      Super pedantic response, yet current estimate is 20 quadrillion ants on Earth. https://www.science.org/content/article/how-many-ants-live-earth https://www.science.org/content/article/how-many-ants-live-e... https://en.wikipedia.org/wiki/Orders_of_magnitude_(numbers) https://en.wikipedia.org/wiki/Orders_of_magnitude_(numbers) Humans: 8,000,000,000 Trees: 3,000,000,000,000 Ants: 20,000,000,000,000,000
    - 6510 3y ago
      I'm not saying aliens....
  - __MatrixMan__ 3y ago
    There are 8 billion people on earth, more or less.
  - croes 3y ago
    8 billion people, 26 billion records. More than 3 per person.
  - mtmail 3y ago
somedude895 3y ago
That term is a bit clickbaity. Mother of all dumps would be more appropriate. This is all from old breaches.
- popcalc 3y ago
  It's more than just a bit clickbaity. There are probably dozens of us on HN who've compiled our own combo DB. This is what dehashed, snusbase, and hibp all are.
- Lendal 3y ago
  The funny thing to me about this title is who brought that term to English in the first place. It came into the vernacular back in 1991 when Saddam Hussein claimed the Kuwait War would become "the mother of all wars". It didn't. It lasted about 24 hours, but the phrase has lasted much longer. It's so weird how language evolves, who has the power to do it, and who doesn't. So for me, the title means that this breach is only of importance to the people who want it to be. Everyone else will simply ignore it after 24 hours, just like the first Kuwait War.
  - JetSpiegel 3y ago
    "This aggression will not stand", as The Dude says
  - modeless 3y ago
    Google Ngram viewer does indicate a sharp rise in use of the phrase starting in 1990: https://books.google.com/ngrams/graph?content=the+mother+of+all&year_start=1700&year_end=2019&corpus=en-2019&smoothing=0 https://books.google.com/ngrams/graph?content=the+mother+of+...
    - smcin 3y ago
      "The mother of all X" (battles/wars/bombs/etc.) a hyperbole that has been used to refer to something as "great" or "the greatest of its kind", became a popular snowclone template in the 1990s. The phrase entered American popular culture in September 1990 at the outset of the Gulf War, when Saddam Hussein's Revolutionary Command Council warned the U.S.-led Coalition against military action in Kuwait with the statement: "Let everyone understand that this battle is going to become the mother of all battles."[ https://en.wikipedia.org/wiki/Snowclone#The_mother_of_all_X https://en.wikipedia.org/wiki/Snowclone#The_mother_of_all_X
__MatrixMan__ 3y ago
Until we stop implicitly trusting third parties with unencrypted data this will continue to feel like not even news.
__MatrixMan__ 3y ago
Until we stop implicitly trusting third parties with unencrypted data this sort of thing will continue to feel like not even news.
- ars 3y ago
  I'm unclear how encrypting the data would help. The same breach that gives access to the data, can also decrypt it. (Also you wrote the same message twice.)
  - oconnore 3y ago
    I think you misunderstand their suggestion. If you only gave service providers access to encrypted data (i.e. End-to-end encryption), then neither the service provider nor the leaker would be able to decrypt. Whether or not that is a generally viable or desirable suggestion is a different question, but it is possible as demonstrated by Signal, Apple, etc.
    - ars 3y ago
      There's only a limited number of things that can be done that way. Basically point-to-point messaging. Most things aren't going to work with that model. Can Amazon ship you products without knowing what you ordered? Can you send and receive email on multiple devices without the provider having your email? Can you join public chat groups? Can you view your lab results without the lab having them? And don't say "the lab can encrypt and send them to you". Your encryption key must be known to the lab, so they can provision a new device for you, in case you lose your phone. Even the vaunted "WhatsApp and Signal" could actually read all your messages if they wanted to - they have your encryption key after all, all they need to do is deploy a version of their application that copies your messages to them. So no, it's not actually possible.
      - deleted 3y ago
        [deleted]
      - __MatrixMan__ 3y ago
pachico 3y ago
What is the real impact on companies that suffer breaches like the ones in that list? Does it really hurt them? Does even the reputation produce any hit on them?
stuff4ben 3y ago
Meh... keep your passwords in an offline password manager and generated for each site. Don't store payment info anywhere, but if you do, make sure it's a generated CC number. Never link your checking or savings account to anything. Sure you'll miss out on some convenience, but you'll have your money and sanity.
- SoftTalker 3y ago
  Until your bank itself leaks the data....
- reidjs 3y ago
  It's unethical, but technically any pressed key or input while on a website could be saved to the site's servers or any servers it ever interacts with, even if you don't save it. So, in addition to your guideline, try to limit the number of websites you input any PII into. IN ADDITION to that, you need to limit the number of people who will take your information in real life and input your information into a system, for example, at a grocery store, gym, bank, dentist, insurance form, or any other service like that. In a way, it's miraculous if one's identity HASN'T been used in nefarious ways without their knowledge, yet.
- barbazoo 3y ago
  > Don't store payment info anywhere, but if you do, make sure it's a generated CC number. Cries in Canadian. As far as I am aware there is no way up here to have more than one virtual card. Please correct me if I'm wrong.
derbOac 3y ago
Clearly better security is always better but sometimes I think there needs to be a different way of approaching identity validation etc. Like, maybe we need to assume everyone's records are leaked somewhere all the time? I'm not sure what that means in practice but I e.g., am not sure that "identity theft" should be a scary thing if the other side of the system is working optimally.
- mschuster91 3y ago
  > I'm not sure what that means in practice but I e.g., am not sure that "identity theft" should be a scary thing if the other side of the system is working optimally. For that, the US needs to follow what virtually all EU member states have done, and provide every citizen with a government-issued ID card with NFC that can be used to authenticate against a website (e.g. a bank), and browsers would need to agree on a web standard allowing interfacing with such cards (there is Web NFC but it's by far not enough). The problem is, this is politically untenable in the US for a bunch of reasons - the right wing complains about "big government" and fears a "nanny state" that tracks everyone and everything, and the left wing complains because ID cards cost money and would exclude people without proper documentation. Additionally, passports don't store your residential address and people don't necessarily want the government to know said address, which means they are useless to banks as a factor proving "person X lives at address Y".
ineptech 3y ago
Question that sounds idiotic but is quite serious: how do I make it illegal to lend money to me without confirmation via Keybase? (edit: or some similar cryptographic identity proof) The only reason to keep my name/address/SSN secret is that companies will lend money to a person who has that info, and then try to make me liable for it regardless of whether that person was me. That's a problem, but the solution isn't for me to keep my identity secret, it's for companies to stop doing that. I should be able to march into some government office, prove my identity to their satisfaction, and give them a private key. Then, if Wells Fargo lends money to someone who can't prove ownership of that key, that's Wells Fargo's problem. Keybase does this fairly well, and is essentially abandonware since the founders were (if I remember right) acquihired by Signal. So, can we just nationalize it or build something similar, declare it to be SSNv2, and move on with our lives?
- bagels 3y ago
  You contribute to campaigns of politicians (aka bribe) and write legislation for them to pass.
  - ineptech 3y ago
    I don't have enough time left on this Earth to explain the concept in a way that politicians could implement, I'm in my 40s. In my preferred alternate universe, Keybase was sold to a benevolent billionaire. Or more realistically, a normal billionaire who intended to run it at a loss until he could leverage it to effect world domination, but managed to mess it up somehow and get it nationalized. Or something. I can dream...
    - bagels 3y ago
      The lobbyists write the legislation and provide the talking points.
    - fsflover 3y ago
      Support https://eff.org https://eff.org and similar organizations.
itrack 3y ago
Any magnet?
- mylastattempt 3y ago
  If you've followed other large / individual leaks, all this data is already there. If you just want a download for convenience, go to the black forums. Or check haveibeenpwned if you're curious for your own company / identity.
bagels 3y ago
Everyone is part of a leak already. It's hard to be bothered by these anymore.
altacc 3y ago
My first thought was "Is this Troy Hunt's hard drive?" but I'm assuming that more bad actors collect security breach data than security researchers. With cyber crime & scams on the rise and earning billions, the value of all that mineable data for bad actors must be high.
charcircuit 3y ago
How is this the mother of all beaches when it is the child of several smaller breaches?
- eviks 3y ago
  It's more like the whole family
bdcravens 3y ago
Not really news. Most of the article says over and over that much of the data is from previous breaches, but some data may be new, without putting any numbers to it.
surge 3y ago
All I see here is someone made a bigger list from multiple other lists from prior breaches. This isn't "the mother of all breaches", this is clickbait. Unless there is some new confirmed breach somewhere that in fact contains 26 billion records ex-filtrated, the only thing this is the mother of is a nothing burger.
- sdflhasjd 3y ago
  I checked for some of my old emails in the list. As far as I can tell, "26B" is due to duplicates and fake data. There were dozens of entries for sites that were never registered for with passwords that were never used. I'd be surprised if it was less than 80% junk.
uptownfunk 3y ago
Is there any technology solution that authenticates via biological signature.. so even if my ssn is public (which is true and unsettling) then I don’t need ssn to be private
jbverschoor 3y ago
It’s like a point in time snapshot do that hackers have a common starting point again
BarbaraMartin 3y ago
[dead]

210 points by el_duderino 3y ago

mangoo84 3y ago

[dead]

Sai_ 3y ago

Clicking on the posted link seems to send the malwarebytes website server into a reload loop.

jacquesm 3y ago

Suggested link change: https://cybernews.com/security/billions-passwords-credentials-leaked-mother-of-all-breaches/ https://cybernews.com/security/billions-passwords-credential... The other is just a way for malwarebytes to get some clicks and contains very little information.

dang 3y ago
Ok, changed to that from https://www.malwarebytes.com/blog/news/2024/01/the-mother-of-all-breaches-26-billion-records-found-online https://www.malwarebytes.com/blog/news/2024/01/the-mother-of... above. Thanks!

hdlothia 3y ago

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statements and hope for the best.

SketchySeaBeast 3y ago
It exhausting. It's a sense of continual doom.
Aardwolf 3y ago
With email addresses you can use multiple to not be too affected. But phone numbers are less replaceable than email addresses... And what's annoying is that more and more things now also require phone numbers (like, seriously, in the past an email address was enough but today the simplest thing you want to signup for uses some third party booking platform (which means yet one more party that gets to leak your data) that wants your phone number; even a railway company can't manage its own login anymore. In the mid 2000's I would have thought phone numbers would die and internet would become the new way to communicate but nope, they suddenly became more important instead)
- lencastre 3y ago
  The simplest thing require full name, address, birthdate, age, yes age, mobile phone, fiscal number, last four digits of the credit card, expiration date of credit card, yomama’s maiden name, the middle 8 digits of your credit, your last used password, your pet’s name, the name of the high school you attended, favorite football team, a front and side pictures no smile no hats no glasses, hi resolution scan of government issued ID, and lastly the first four digits. That’s about it.
  - Aeolun 3y ago
    Hey! Don’t you have all digits of my CC now?!
autoexec 3y ago
I still feel like this is why the penalties for allowing user's data to be leaked should be harsh enough to make it worthwhile for companies take even basic steps to protect other people's data, or even better, to avoid collecting it or keeping it in the first place. Since that hasn't happened yet, I try to avoid handing my data over when I can.
- stvltvs 3y ago
  Agreed, perhaps requiring companies who handle sensitive data to carry insurance and licensing engineers who build those systems, something like the PE.
  - doubled112 3y ago
    > licensing engineers who build those systems The IT and software industries would really change. Perhaps for the better, but perhaps not.
    - HeatrayEnjoyer 3y ago
      I can't possibly see it becoming worse. This isn't the 90s any more, computing and the internet are no longer cute novelties but infrastructure just as critical as electricity or airport communication. Software "engineering" has been due for the professional licensure and direct liability that every other serious industry has had for a century.
basch 3y ago
It’s time for attorney generals to hold permanent identity monitoring pots and funds. The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years. If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to run with lower margins if they stay secure. As companies die out, the remaining breaches ones are responsible to keep footing the bill.
- stvltvs 3y ago
  It should all be free, like getting credit reports is now. We need a robust and accessible way to manage our data personas, assuming that all of the supposed secrets are in fact public data.
  - kingforaday 3y ago
    As a reminder for any US Citizens, there is an official path to getting this from each of the main three for free[1] is the approved method verified by FTC [2]. 1. https://annualcreditreport.com https://annualcreditreport.com 2. https://consumer.ftc.gov/articles/free-credit-reports https://consumer.ftc.gov/articles/free-credit-reports
    - kmoser 3y ago
      This still puts the burden on the consumer of having to verify that their credit file is accurate, not to mention the even bigger burden of trying to correct it.
      - Rewrap3643 3y ago
        Furthermore it's a reactive measure. Locking credit reports and unlocking as needed can help mitigate some risks.
- kelseyfrog 3y ago
  It also incentivizes holding as little personal data as possible and increases the probability of coordinated adoption of systems[1][2][3][4][5] of identification/verification that minimize collateral damage. 1. https://sovrin.org/ https://sovrin.org/ 2. https://github.com/sertoID/ https://github.com/sertoID/ 3. https://www.hyperledger.org/projects/hyperledger-indy https://www.hyperledger.org/projects/hyperledger-indy 4. https://identity.foundation/ion/ https://identity.foundation/ion/ 5. https://www.civic.com/ https://www.civic.com/
namaria 3y ago
I'd say it's an inevitable state of affairs. With networked general computers the amount of leaked information tends to 100% of available information over time. Unless you can design, build and run absolutely safe systems. Cybersecurity is a sham, a bolt on industry extracting rent out of the mobile internet junkies we've become. We want to have an endless stream of entertainment and trivia so bad we've actually built homes with locks that connect to the internet. You'd think a networked lock defeats its purpose.
- deleted 3y ago
  [deleted]
barrysteve 3y ago
Long since resigned. It's impossible to keep a secret on the internet. You can't secure military technology, bank secrets, crypto tokens or prevent piracy. Computers were designed to be open by default. General purpose computing mannufactured across the planet with everybody having a hand in the supply chain has become the betrayal system. Security follows the traditional Mafia protection scheme racket. - Some Romanian hacker leaks data from your web server and sells it. - You pay developers to close the vuln. - You pay cybersecurity a protection fee to prevent it happening again. - It happens again. Developing a real technology that can give secure control back to the owner-operator goes against good business incentives. You can't farm users and share the wealth on a truly secure computing model.
chankstein38 3y ago
100% with you. At this point my data has been breached so many times I don't even know what the point of caring is. I don't have privacy anymore. Like you I just have credit monitoring and watch my financial statements and hope for the best. This world sucks.
- WhackyIdeas 3y ago
  Know what? I heard it was illegal in the UK to give websites fake information. But looking at that list of websites justifies what I have been doing for the past 18 years religiously. When a website asks my age, I give it a fake one. When a shop asks for my debit card details I give it my initials J B and then I will confirm the sms security from my bank when the initials flag 30% of the time. Giving every company real data just means it gets leaked. That list of hacked domain names covers just about everyone. Wow.
  - chankstein38 3y ago
    100% with you. It depends on the site but yeah a lot of my information is fake. I really don't understand why so many websites think they need things like my address or phone number anyway. Good thing I live on 100 YouDontNeedThis Blvd!
Aeolun 3y ago
That’s honestly not very surprising when any company that does this has to suffer the consequences of… crickets? No consequences at all. It’s no surprise that patching the holes costs them more. It’s also that all these massive companies are absolutely allergic to any change. Unless legal gets wind of it everything can stay exposed if it means the status quo is maintained.
godelski 3y ago
I just went through a call with my credit card company. 4 transfers later the only verification I've been asked is the last 4 of my social, my name, and when I was at the "highest level" of security they took the amazing step to... call me back. All because my credit card, which is travel focused, got flagged because I bought a <$300 plane ticket... They claimed I got an email and text message, which I got neither (I'm sure the email got filtered and same with the text message. Thanks Google. I'm glad you filtered those but not the emails addressed to someone else, "from" a hashed domain, and where the header is passed through 5 relay services -- including several .edus. -____-) You are not alone. It is an __absolute joke__ that my github account is more secure than any banking service I use. How is it that the only 2FA they offer is text message? A method that's been known to be terrible for over a decade now. Where are my OTPs? They give me apps on my phone, why not push verification there? (Vanguard recently started doing this) Why can't I set up hardware keys or public private keypairs? Sure, I get that you still got to service grandma and grandpa, but at least give me something. In today's day and age the two most important services I have are email and banking. The former is impossible to resolve when shit hits the fan and the latter doesn't even implement basic security. Something is very wrong, and I'm not sure it is even about money (unless short term vs long term). Dinky little websites implement better security than most baking services. Clearly the banks could reduce their spending on fraud detection and resolution if they added some basic security. I will note that I had a Capital One account that used the card as a 2FA into the phone app. Was neat, other than Capital One was a whole shitshow on its own. I'm also very surprised at how much spam gets through services like Gmail and Twitter which could be easily detected by Naive Bayes filters. Something is very wrong.
- kesslern 3y ago
  I can log into chase.com with my password in any case. Banking security is an absolute joke. The interesting part is that if I have to do a 2FA SMS challenge, I am required to re-enter my password. At this point the password checking becomes case sensitive.
  - wlesieutre 3y ago
    "In any case" meaning you can change capitalization and it still works? This doesn't work on my chase.com account.
instagib 3y ago
The SEC had a disclosure recently which had an effect on the bitcoin market. They turned off MFA and forgot to re-enable it supposedly as well as it was a sim swap attack. The OPM data breach was bad. So much data on there about the individuals and a few degrees of association away from them. Every security question and answer are there. I had 4 data breaches last year and one so far this year I just posted about today that I have no idea how they got my information (0). Mail was stolen by a petty theft and identity theft ring which called to try to get more out of me a couple years ago. Freezing your credit is the best course of action. I don’t really worry about it much anymore. (0) https://news.ycombinator.com/item?id=39101272 https://news.ycombinator.com/item?id=39101272
GuB-42 3y ago
The problem is that as long as there are attackers willing to spend resources, there is no limit to spending money on security, it is adversarial. At some point, security will cost more than what you are securing, and that's when people drop the ball and prefer to deal with the consequences. Same ideas as with bicycles. Thieves now have sufficiently advanced tools that people stop buying the kind locks that could possibly stop them, and instead just assume that left unattended in the outside, their bike will be stolen eventually, and deal with it. For example by not having nice bikes, or by not biking unless there is a safe place for that bike. So yeah, leaks will happen. Unless maybe you get a combination of well designed and enforced security standards, harsh penalties for cybercrime, and international collaboration.
1970-01-01 3y ago
Yes. Corporations really do just lose your info and move on as quietly as possible. You can try to not give real info to anyone that isn't the government.
harry8 3y ago
They win as long as deliberately making this decision, probably so, at a level way beyond what the reasonably competent person the field could do by accident never results in a conviction recorded and jail term against the ceo and board. The individuals need to be charged and have there day in court with consequences that go beyond “business expense” Conviction recorded is just that. Who will lobby for it because /you/ don’t count? Too poor to matter to law makers.
jjav 3y ago
> I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. They do win, unfortunately because they're right. Why spend much on designing security when the inevitable breach costs nothing other than bad press for a few days and then all is forgotten. The only possible solution is to have significant fines for every data item breached. Ideally I'd ratchet up the fines for each occurrence. First breach should hurt the company financially a bit but not be too disruptive, offering a learning opportunity. Subsequent breaches the fines go up, by the fifth breach or so the fines would wipe away the company entirely, since they clearly didn't learn. Anything short of something like this, companies will never care and leak all your data to the wind every year.
- queuebert 3y ago
  This would be create an incentive to attack a competing company until you breach it 5x, causing its destruction. Competitors would be attacking each other nonstop. Like 3 check chess, but in Delaware.
  - jjav 3y ago
    I don't have a huge problem with that to be honest. Maybe not fifth breach, but something along those lines. Well-funded attackers and competing nations are already attacking these companies, so adding their competitors to the mix doesn't change a lot.
    - josephg 3y ago
      Yep. And if staying in business means keeping your website secure, well, isn’t that the goal? I think part of the problem is that hacker movies make people think hacking is inevitable. Like you can’t actually protect your site and your data from the average punk on roller skates, so why bother? But that’s not true at all. Gmail has - as far as we know - never been breached by anything short of a nation state attacker. And I’m sure a lot of people have tried. You just need to actually care about security and follow best practices (like doing audits / red team and keep up to date with security patches). But most companies only seem interested in properly investing in security if it’s an existential threat.
specialist 3y ago
> Does anyone else feel this way? Since the mid 2000s. I worked very hard trying to figure out how to protect patient data. To do so requires translucent database techniques. Which means encrypting all potential PII data at rest at the field level. Exactly like how passwords are stored, extended to all PII. Which requires globally unique identifiers issued by CAs. Just like RealID. Nothing will improve until people accept this fundamental technical truth. Also, on the policy side, PII needs be be changed from an asset to a liability. And ban data hoarding stuff like targeted ads and relevant search.
wredue 3y ago
The easiest thing is to just stop registering for useless garbage.
- brewtide 3y ago
  Recently both my mortgage company, who bought my mortgage from another company without any say from me in the matter, had a giant leak. You heard about it. I'm hardly alone . Then Comcast/Xfinity, same thing. I have 2 options for internet, now, it seems. Comcast or now starlink. Point is, you can plunk your information into relative bare-minimum of sketchiness -- and you'll still be screwed over.
SlightlyLeftPad 3y ago
Probably about 10-12 years ago I almost exclusively used +emails so I could determine with pretty high confidence who had breaches and failed to disclose OR identify companies that had sold my data without disclosure. One of the most recent examples was Robinhood Holdings. +emails only got me so far as 50% of sites don’t properly support the RFC5233 subaddressing standard and it ended up being a massive pain when a sign up page accepts the plus sign, stores an improperly escaped version of that and then you can’t login or never get the verification email. Fast forward to 2021, apple released hide-my-email which I use practically everywhere which forwards to a burner email just in case. Every site gets a unique email, password, two-factor. I’ll never have 0 risk but this limits my exposure so much it lets me sleep at night. I only provide real information if absolutely required by law.
- geraldhh 3y ago
  yea, glad i didn't hop on the +mail thing. catch-all email domains just work, thou it's a bit of a hassle to configure the sending address depending on the mua (ios mail grr)
- Semaphor 3y ago
  Same here, only I don’t use an external service and simply use my own domain for unique email addresses.
- cryptoegorophy 3y ago
  I wish hide my email was released 20 years earlier.
simonebrunozzi 3y ago
Same for me. Big fail for regulation and government oversight.
j-bos 3y ago
I don't. I grew up where break-ins were not an uncommon occurance, so anything that shares my name, finances and address feels like gross negligence.
geraldhh 3y ago
> I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. and it's not like it wasn't forseeable 20/40/60 years ago. thou the question remains what would be the alternative? what really bugs me is the fact that it essentially puts all the 'nothing to hide, have my data' folks in the right because, yea, why bother.
lofaszvanitt 3y ago
That's why you register with garbage personal details.

freitzkriesler2 3y ago

I skimmed the article but it wasn't clear to me specifically what was leaked. Do they have clear text usernames and passwords? Are the PW hashed?

huytersd 3y ago

So 3 records for each person on earth. Nice.

SOVIETIC-BOSS88 3y ago
Title says billions, not trillions.
- evan_ 3y ago
  are you counting ants as people?
  - fuzztester 3y ago
    at the rate we are going, soon ants will be counting people.
  - araes 3y ago
    Super pedantic response, yet current estimate is 20 quadrillion ants on Earth. https://www.science.org/content/article/how-many-ants-live-earth https://www.science.org/content/article/how-many-ants-live-e... https://en.wikipedia.org/wiki/Orders_of_magnitude_(numbers) https://en.wikipedia.org/wiki/Orders_of_magnitude_(numbers) Humans: 8,000,000,000 Trees: 3,000,000,000,000 Ants: 20,000,000,000,000,000
  - 6510 3y ago
    I'm not saying aliens....
- __MatrixMan__ 3y ago
  There are 8 billion people on earth, more or less.
- croes 3y ago
  8 billion people, 26 billion records. More than 3 per person.
- mtmail 3y ago

somedude895 3y ago

That term is a bit clickbaity. Mother of all dumps would be more appropriate. This is all from old breaches.

popcalc 3y ago
It's more than just a bit clickbaity. There are probably dozens of us on HN who've compiled our own combo DB. This is what dehashed, snusbase, and hibp all are.
Lendal 3y ago
The funny thing to me about this title is who brought that term to English in the first place. It came into the vernacular back in 1991 when Saddam Hussein claimed the Kuwait War would become "the mother of all wars". It didn't. It lasted about 24 hours, but the phrase has lasted much longer. It's so weird how language evolves, who has the power to do it, and who doesn't. So for me, the title means that this breach is only of importance to the people who want it to be. Everyone else will simply ignore it after 24 hours, just like the first Kuwait War.
- JetSpiegel 3y ago
  "This aggression will not stand", as The Dude says
- modeless 3y ago
  Google Ngram viewer does indicate a sharp rise in use of the phrase starting in 1990: https://books.google.com/ngrams/graph?content=the+mother+of+all&year_start=1700&year_end=2019&corpus=en-2019&smoothing=0 https://books.google.com/ngrams/graph?content=the+mother+of+...
  - smcin 3y ago
    "The mother of all X" (battles/wars/bombs/etc.) a hyperbole that has been used to refer to something as "great" or "the greatest of its kind", became a popular snowclone template in the 1990s. The phrase entered American popular culture in September 1990 at the outset of the Gulf War, when Saddam Hussein's Revolutionary Command Council warned the U.S.-led Coalition against military action in Kuwait with the statement: "Let everyone understand that this battle is going to become the mother of all battles."[ https://en.wikipedia.org/wiki/Snowclone#The_mother_of_all_X https://en.wikipedia.org/wiki/Snowclone#The_mother_of_all_X

__MatrixMan__ 3y ago

Until we stop implicitly trusting third parties with unencrypted data this will continue to feel like not even news.

__MatrixMan__ 3y ago

Until we stop implicitly trusting third parties with unencrypted data this sort of thing will continue to feel like not even news.

ars 3y ago
I'm unclear how encrypting the data would help. The same breach that gives access to the data, can also decrypt it. (Also you wrote the same message twice.)
- oconnore 3y ago
  I think you misunderstand their suggestion. If you only gave service providers access to encrypted data (i.e. End-to-end encryption), then neither the service provider nor the leaker would be able to decrypt. Whether or not that is a generally viable or desirable suggestion is a different question, but it is possible as demonstrated by Signal, Apple, etc.
  - ars 3y ago
    There's only a limited number of things that can be done that way. Basically point-to-point messaging. Most things aren't going to work with that model. Can Amazon ship you products without knowing what you ordered? Can you send and receive email on multiple devices without the provider having your email? Can you join public chat groups? Can you view your lab results without the lab having them? And don't say "the lab can encrypt and send them to you". Your encryption key must be known to the lab, so they can provision a new device for you, in case you lose your phone. Even the vaunted "WhatsApp and Signal" could actually read all your messages if they wanted to - they have your encryption key after all, all they need to do is deploy a version of their application that copies your messages to them. So no, it's not actually possible.
    - deleted 3y ago
      [deleted]
    - __MatrixMan__ 3y ago

pachico 3y ago

What is the real impact on companies that suffer breaches like the ones in that list? Does it really hurt them? Does even the reputation produce any hit on them?

stuff4ben 3y ago

Meh... keep your passwords in an offline password manager and generated for each site. Don't store payment info anywhere, but if you do, make sure it's a generated CC number. Never link your checking or savings account to anything. Sure you'll miss out on some convenience, but you'll have your money and sanity.

SoftTalker 3y ago
Until your bank itself leaks the data....
reidjs 3y ago
It's unethical, but technically any pressed key or input while on a website could be saved to the site's servers or any servers it ever interacts with, even if you don't save it. So, in addition to your guideline, try to limit the number of websites you input any PII into. IN ADDITION to that, you need to limit the number of people who will take your information in real life and input your information into a system, for example, at a grocery store, gym, bank, dentist, insurance form, or any other service like that. In a way, it's miraculous if one's identity HASN'T been used in nefarious ways without their knowledge, yet.
barbazoo 3y ago
> Don't store payment info anywhere, but if you do, make sure it's a generated CC number. Cries in Canadian. As far as I am aware there is no way up here to have more than one virtual card. Please correct me if I'm wrong.

derbOac 3y ago

Clearly better security is always better but sometimes I think there needs to be a different way of approaching identity validation etc. Like, maybe we need to assume everyone's records are leaked somewhere all the time? I'm not sure what that means in practice but I e.g., am not sure that "identity theft" should be a scary thing if the other side of the system is working optimally.

mschuster91 3y ago
> I'm not sure what that means in practice but I e.g., am not sure that "identity theft" should be a scary thing if the other side of the system is working optimally. For that, the US needs to follow what virtually all EU member states have done, and provide every citizen with a government-issued ID card with NFC that can be used to authenticate against a website (e.g. a bank), and browsers would need to agree on a web standard allowing interfacing with such cards (there is Web NFC but it's by far not enough). The problem is, this is politically untenable in the US for a bunch of reasons - the right wing complains about "big government" and fears a "nanny state" that tracks everyone and everything, and the left wing complains because ID cards cost money and would exclude people without proper documentation. Additionally, passports don't store your residential address and people don't necessarily want the government to know said address, which means they are useless to banks as a factor proving "person X lives at address Y".

ineptech 3y ago

Question that sounds idiotic but is quite serious: how do I make it illegal to lend money to me without confirmation via Keybase? (edit: or some similar cryptographic identity proof) The only reason to keep my name/address/SSN secret is that companies will lend money to a person who has that info, and then try to make me liable for it regardless of whether that person was me. That's a problem, but the solution isn't for me to keep my identity secret, it's for companies to stop doing that. I should be able to march into some government office, prove my identity to their satisfaction, and give them a private key. Then, if Wells Fargo lends money to someone who can't prove ownership of that key, that's Wells Fargo's problem. Keybase does this fairly well, and is essentially abandonware since the founders were (if I remember right) acquihired by Signal. So, can we just nationalize it or build something similar, declare it to be SSNv2, and move on with our lives?

bagels 3y ago
You contribute to campaigns of politicians (aka bribe) and write legislation for them to pass.
- ineptech 3y ago
  I don't have enough time left on this Earth to explain the concept in a way that politicians could implement, I'm in my 40s. In my preferred alternate universe, Keybase was sold to a benevolent billionaire. Or more realistically, a normal billionaire who intended to run it at a loss until he could leverage it to effect world domination, but managed to mess it up somehow and get it nationalized. Or something. I can dream...
  - bagels 3y ago
    The lobbyists write the legislation and provide the talking points.
  - fsflover 3y ago
    Support https://eff.org https://eff.org and similar organizations.

itrack 3y ago

Any magnet?

mylastattempt 3y ago
If you've followed other large / individual leaks, all this data is already there. If you just want a download for convenience, go to the black forums. Or check haveibeenpwned if you're curious for your own company / identity.

bagels 3y ago

Everyone is part of a leak already. It's hard to be bothered by these anymore.

altacc 3y ago

My first thought was "Is this Troy Hunt's hard drive?" but I'm assuming that more bad actors collect security breach data than security researchers. With cyber crime & scams on the rise and earning billions, the value of all that mineable data for bad actors must be high.

charcircuit 3y ago

How is this the mother of all beaches when it is the child of several smaller breaches?

eviks 3y ago
It's more like the whole family

bdcravens 3y ago

Not really news. Most of the article says over and over that much of the data is from previous breaches, but some data may be new, without putting any numbers to it.

surge 3y ago

All I see here is someone made a bigger list from multiple other lists from prior breaches. This isn't "the mother of all breaches", this is clickbait. Unless there is some new confirmed breach somewhere that in fact contains 26 billion records ex-filtrated, the only thing this is the mother of is a nothing burger.

sdflhasjd 3y ago
I checked for some of my old emails in the list. As far as I can tell, "26B" is due to duplicates and fake data. There were dozens of entries for sites that were never registered for with passwords that were never used. I'd be surprised if it was less than 80% junk.

uptownfunk 3y ago

Is there any technology solution that authenticates via biological signature.. so even if my ssn is public (which is true and unsettling) then I don’t need ssn to be private

jbverschoor 3y ago

It’s like a point in time snapshot do that hackers have a common starting point again

BarbaraMartin 3y ago

[dead]