You want to reveal the password you use to sign on to your bank online? No? No problem. We can always get it from the Russians. According to the New York Times
A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say.
The records, discovered by Hold Security, a firm in Milwaukee, include confidential material gathered from 420,000 websites, including household names, and small Internet sites. Hold Security has a history of uncovering significant hacks, including the theft last year of tens of millions of records from Adobe Systems.
[…]
“Hackers did not just target U.S. companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites,” said Alex Holden, the founder and chief information security officer of Hold Security. “And most of these sites are still vulnerable.”
[…]
The hacking ring is based in a small city in south central Russia, the region flanked by Kazakhstan and Mongolia. The group includes fewer than a dozen men in their 20s who know one another personally — not just virtually. Their computer servers are thought to be in Russia.
Hold Security refused to identify the victims, citing nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable. But the Times hired its own independent security expert, who analyzed the database of stolen credentials and confirmed its authenticity.
This theft is not a one-off occurrence, the article goes on to note:
[F]or all the new security mousetraps, data security breaches have only gotten larger, more frequent and more costly. The average total cost of a data breach to a company increased 15 percent this year from last year, to $3.5 million per breach, from $3.1 million, according to a joint study last May, published by the Ponemon Institute, an independent research group, and IBM.
Last February, Mr. Holden also uncovered a database of 360 million records for sale, which were collected from multiple companies.
“The ability to attack is certainly outpacing the ability to defend,” said Lillian Ablon, a security researcher at the RAND Corporation. “We’re constantly playing this cat and mouse game, but ultimately companies just patch and pray.”
Clearly, high technology comes with its costs. Who knew they could run this high?
