E-mail users affected by the massive breach, which saw 711million address e-mail addresses leaked, have been advised to change their passwords right now.
The breach, one of the largest of its kind, also saw passwords linked to millions of the affected e-mail accounts published.
The e-mail accounts affected are from all around the world, and they have been published on an open and accessible web server hosted in the Netherlands.
The huge number of leaked e-mail addresses is almost equivalent to number of every man, woman and child in the whole of Europe.
To check if your e-mail address has been affected by the breach, you need to go to haveibeenpwned.com.
The e-mail breach was outlined by Australian computer security expert Troy Hunt, who runs the Have I Been Pwned website.
In a blog post, he wrote: “Last week I was contacted by someone alerting me to the presence of a spam list. A big one.
“That’s a bit of a relative term though because whilst I’ve loaded ‘big’ spam lists into Have I been pwned (HIBP) before, the largest to date has been a mere 393m records and belonged to River City Media.
“The one I’m writing about today is 711m records which makes it the largest single set of data I’ve ever loaded into HIBP.
“Just for a sense of scale, that’s almost one address for every single man, woman and child in all of Europe.
“This blog posts explains everything I know about it.”
The spambot which has access to this huge list of 711m e-mail addresses is called Onliner, and has been operational since 2016.
It is being used to spread a banking trojan called Ursnif, which downloads onto a victim’s machine and delivers a malicious payload.
It’s used to steal sensitive browsing data such as banking and credit card information, acquired through taking screenshots and keylogging.
The Onliner breach has seen millions of e-mail passwords published online, and Hunt has analysed where some of these login credentials could have come from.
He explained that a random test of a dozen different e-mail addresses showed every one of them came from a previous LinkedIn data breach.
Hunt said: “A random selection of a dozen different email addresses checked against HIBP showed that every single one of them was in the LinkedIn data breach.
“Now this is interesting because assuming that’s the source, all those passwords were exposed as SHA1 hashes (no salt) so it’s quite possible these are just a small sample of the 164m addresses that were in there and had readily crackable passwords.”
If you receive any suspicious e-mails from an unknown address, which often are disguised as invoices, don’t click on them.
And if you’re e-mail address appears to be compromised after doing a search on Have I Been Pwned, ensure you change your password immediately.
Hunt said: “For this particular incident, if you’re creating strong, unique passwords on each service (get a password manager if you don’t have one already) and using multi-step verification wherever possible, I wouldn’t be at all worried.
“If you’re not, now’s a great time to start.”
You should always use a unique password for each one of your online accounts.
This means that – should one of your online accounts be compromised in an online leak or hack – hackers are not able to replicate the combination of your email and password to access other online logins.
A password manager is one way to generate and securely store unique passwords with letters, symbols and numbers.
Alternatively, one way to create a secure password is to take the first letter of each word in your favourite song lyric, phrase or poem and use those letters, which should appear like a random jumble of random characters, as your password.