Collection with 2.2 billion accounts was online

A database with a total of 2.2 billion account names and passwords was available for download online. It seems to be a collection of accounts from previous hacks and data breaches. The collection has been downloaded more than a thousand times.

Hackers have put the collection in a torrent and it has been downloaded a total of 1,000 times and was seeded by 130 people, Wired writes after Heise.de has already come across the collection. The readme file accompanying the torrent stated that the distributor wanted as many people as possible to seed it. That makes the data worthless for sale, because everyone can use it.

While some come from well-known data breaches such as Dropbox, Yahoo, and LinkedIn, it appears that many of the accounts and passwords are new. They seem to come from the automated hacking of smaller websites.

The database, named Collection #2-5, follows the discovery of Collection #1 two weeks ago from the HaveIBeenPwned site. It contained 773 million email addresses. Many of them are also in the new collection.

Whether an email address exists can be seen in a tool of the Hasso-Plattner Institute. After entering an e-mail address, the latter sends an e-mail to that address with a table of databases containing that e-mail address. It states that the collection contains a total of 2,191,498,885 e-mail addresses.