The 2014 Russian hacker password theft is an alleged hacking incident resulting in the possible theft of over 1.2 billion internet credentials, including usernames and passwords, with hundreds of millions of corresponding e-mail addresses. The data breach was first reported by ''

The New York Times ''The New York Times'' (''the Times'', ''NYT'', or the Gray Lady) is a daily newspaper based in New York City with a worldwide readership reported in 2020 to comprise a declining 840,000 paid print subscribers, and a growing 6 million paid ...

'' after being allegedly discovered and reported by

Milwaukee Milwaukee ( ), officially the City of Milwaukee, is both the most populous and most densely populated city in the U.S. state of Wisconsin and the county seat of Milwaukee County, Wisconsin, Milwaukee County. With a population of 577,222 at th ...

-based information security company,

Hold Security Hold may refer to: Physical spaces * Hold (ship), interior cargo space * Baggage hold, cargo space on an airplane * Stronghold, a castle or other fortified place Arts, entertainment, and media * Hold (musical term), a pause, also called a Fermat ...

. 420,000 websites are reported to be affected. According to ''The New York Times'', some big companies knew that their user's credentials are among the stolen. Hold Security did not disclose which sites were compromised, but, instead, offered two separate services, one for website owners and one for consumers to check if they're affected. The service for website owners costs $10 a month. The check for consumers is free. Hold Security described the group responsible for the hack as a small group of "fewer than a dozen men in their 20s ... based in a small city in south central Russia, the region flanked by Kazakhstan and Mongolia", and dubbed the group ''CyberVor'' ( Russian, lit. "cyber thief"). Hold claimed the hack was perpetrated through the use of

SQL injection In computing, SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL inj ...

. According to a

Forbes ''Forbes'' () is an American business magazine owned by Integrated Whale Media Investments and the Forbes family. Published eight times a year, it features articles on finance, industry, investing, and marketing topics. ''Forbes'' also r ...

article, Hold Security says that not all the 1.2 billion credentials were stolen this way, there are also ones that CyberVor simply bought from people that used other means, and Hold Security doesn't know what the split is.

Criticism of Hold Security

Forbes columnist, Kashmir Hill, noted "The Internet predictably panicked as the story of yet another massive password breach went viral." and " is is a pretty direct link between a panic and a pay-out for a security firm." Hold Security's website has a service offering people to check if their username and password pair has been stolen. It requires people to send Hold Security encrypted versions of their passwords.

Skepticism

No named independent sources came forward to confirm the breach, and Forbes columnist,

Joseph Steinberg Joseph Steinberg (April 22, 1883 – November 27, 1932) was an American lawyer and politician from New York. Early life He was born on April 22, 1883, in Manasquan, New Jersey. He attended Manasquan High School. He graduated from the College of ...

, even expressed outright skepticism about many of the "facts" claimed about the breach, raising questions about the trustworthiness of the reports of the breach altogether.

References

{{Hacking in the 2010s Computer security exploits Internet security 2014 in computing Hacking in the 2010s 2014 crimes in Russia Data breaches