A Paris-Based Researcher Spotted 711 million Email Accounts Lying In Plain Text Files On A Server Hosted In Netherlands

The researcher mentioned his findings in a blog post. The said server was used by a spambot known as ‘Onliner’. And the text files, amounting to 40+ GBs, also contain other details like passwords and details of the email servers used to send the spam.

It has been known that this massive “biggest of its kind” spamming campaign is a launch pad to spread a banking malware called Ursnif. As of now, more than 100,000 different infections have occurred, ZDNet reports.

It’s hard to point out the exact source from where the email accounts and data was collected. But, previous breaches like that of Linkedin did make a considerable contribution.

The unsorted list discovered by Benkow, analyzed by Troy Hunt, contained 80 million emails which were then used to send spams to another 630 million. The hackers used the SMTP servers and ports linked to these email accounts to spread the spam in a way that looks legitimate. In fact, the user credentials were verified against the SMTP servers; the one which didn’t authenticate were not used.

Image: List of data dump files.

Hunt operates the site Have I Been Pwned?. You can visit the same to know if your email is included in the breach. Hunt said that this is the “largest single set of data I’ve ever loaded into HIBP.”

“Just for a sense of scale, that’s almost one address for every single man, woman, and child in all of Europe.”

Also, a considerable number of entries from the email data was already present in HIBP’s existing database. In his blog post, Hunt says that the findings can be filtered into two categories:

• Email addresses used to deliver the spams to.
• Email addresses and passwords for which the hackers abused their SMTP server to deliver the spam.

There was one “uncomfortable truth” waiting for Hunt, his own email address was present in the list. Thankfully, I have not been pwned.

The irregular construct of the data, mainly sourced from the web, makes the 711 million figure “technically inaccurate” and he said the actual number of humans involved might be somewhat less.

Visit Have I Been Pwned to check your email. Read Hunt’s blog post for more details using this link.