A massive hack occurred over the 4th of July holiday, when 10 billion unique passwords were exposed by users and customers on a host of popular websites, including Ticketmaster and Santander.
The plaintext file, called RockYou2024, exposed the passwords of customers all over the world. The data is believed to have been collected through a series of hacks two decades.
Connected: Ticketmaster Hack Affects Over 560 Million Customers
“Essentially, the RockYou2024 leak is a compilation of real-world passwords used by individuals around the world. Revealing that many passwords to threat actors significantly increases the risk of credential stuffing attacks,” researchers for CyberNews said. “Threat actors can exploit RockYou2024's password compilation to perform brute-force attacks and gain unauthorized access to various online accounts used by individuals using passwords included in the dataset.”
The CyberNews team noted that the leak, combined with other breaches that exposed email addresses and phone numbers, could lead to “a cascade of data breaches, financial fraud and identity theft.”
Bad actors could attempt to attack anything from “webcams and even industrial equipment,” they added.
For example, if a hacker sees that your email address is linked to the password in the RockYou2024 file, they can check if you use the same password for your email address for another company discovered in a separate hack.
Although this hack is said to be the biggest in history, it is not the first “RockYou” incident.
Connected: AT&T customer data leaked to the 'Dark Web', affecting millions
In 2021, RockYou2021 was released, containing about 8.4 billion passwords. RockYou2024 is thought to include these passwords plus an additional 1.5 billion collected over the past three years. RockYou2021 was mostly composed of social media account passwords.
CyberNews recommends changing passwords used across multiple websites or accounts and enabling multi-factor authentication on every possible device.