Cybersecurity experts have found a huge cache of stolen data containing 26 million logins for popular websites including Amazon, Facebook and Netflix.
Hackers used malware to steal 1.2 terrabytes of data, including payment information, from three billion Windows-based computers between 2018 and 2020.
In addition to logins, the database held more than 2 billion cookies and 6.6 million other files.
Around half of these were text files, many of which contained login credentials users may have saved to their desktops.
Payment information and autofill data was also stolen from apps like web browsers.
The massive data breach was discovered by cybersecurity firm Nordlocker, who said that a so-called ‘nameless malware’ had been used to collect data from user devices.
This type of custom malware, which was transmitted via email and illegally downloaded software, can be bought online for as little as $100 (£70), the firm says.
A Nordlocker spokesperson said a hacker group accidently revealed the location of the database.
Who stole the data, and whether any of it has been used maliciously, remains unknown.
You can find out if your email address or phone number has been compromised in a data breach on the Have I Been Pwned? website.
Malware attacks and other forms of cyber crime have become major security concerns in recent years.
In the last two months alone, hackers have shut down a major US fuel pipeline and a network of slaughterhouses.
A new taskforce set up to tackle digital attacks in the US announced it had made its first criminal charge in early June.
The taskforce accused Latvian hacker Alla Witte of involvement in plots to target schools and hospitals
A devastating malware attack has allowed hackers to steal millions of account logins for online sites and services.
Sign-in details for pretty much any online account you can think of – Apple, Amazon, Facebook, Netflix, eBay, Instagram – have been captured by those responsible.
It was first uncovered by cyber security researchers at NordLocker who explained that a Trojan-type malware stole the credentials between 2018 and 2020.
They found a 1.2-terabyte database of stolen login details that had been lifted from 3.25 million Windows PC.
The database included payment information linked to bank accounts.
This type of custom malware, which was transmitted via email and illegally downloaded software, can be bought online for as little as $100 (£70), the firm says.
A Nordlocker spokesperson said a hacker group accidently revealed the location of the database which allowed them to discover the extent of the damage.
How to find out if your details have been stolen
All of the details trace back to 1,121,484 email addresses that were used to create the various accounts.
Thanks to the work of NordLocker and the free-to-use website HaveIBeenPwned?, anyone can run a search to see if their email has been caught up in the hack.
All you have to do is visit the website here and input any email addresses you use for things like Netflix, Instagram, Facebook, etc.
The site will tell you if you’ve been affected by the hack.
Next steps? Well, we would recommend immediately going to any and all services that you’ve signed up to with that particular email address and change the password immediately.
It may also be worth putting some extra antivirus software on your PC and running some scans to make sure there’s no malware hiding away somewhere.
mrto
