773M Password 'Megabreach' is Years Old773M Password 'Megabreach' is Years Old

In mid-January 2019, security researcher Troy Hunt, who runs the breach notification service Have I Been Pwned, announced that he had loaded a massive credential dump known as Collection #1. The data, originally hosted on the file-sharing service Mega and circulated on hacking forums, consisted of about 12,000 files totaling 87 gigabytes and more than 2.7 billion rows of email and password combinations. Hunt said he learned of the files after several people contacted him about them, and that his own email address and an old password appeared in the set.

After removing duplicates, Hunt counted about 773 million unique email addresses and roughly 21 million unique passwords, many stored in plaintext. It was the single largest breach he had ever added to the service. Unlike a traditional breach, Collection #1 did not come from one company. It was a compilation assembled from thousands of earlier leaks, the kind of list criminals use for credential stuffing attacks that test reused passwords against other websites.

Reporting by Brian Krebs found that the seller, who went by the name Sanixer, described Collection #1 as at least two or three years old and part of a larger offering. The seller advertised additional sets, later known as Collections #2 through #5, totaling several hundred gigabytes and billions more records. Threat intelligence firms said much of Collection #1 already existed in their databases, which tempered claims that it represented a fresh compromise.

There were no fines or corporate defendants because no single organization was responsible. The practical fallout landed on individuals: millions of people learned through Have I Been Pwned and media coverage that their email address and a password were in circulation. Password managers and browsers expanded breach-checking features, and Hunt's companion Pwned Passwords service, which lets sites block known compromised passwords, saw heavy use.

Collection #1 helped mainstream the idea that the main danger of old breaches is password reuse. A credential stolen from a defunct forum years ago can still unlock an email, shopping or banking account today if the same password is used. The standard advice that followed, using a unique password for every site and enabling multi-factor authentication, remains the most effective defense against these compilations.