Cybercriminals have published millions of email addresses as well as usernames and passwords of online accounts in channels of the messenger service Telegram, according to the operator of the site “Have-I-been-pwnd”.
According to a recent blog post by Troy Hunt, unknown persons have published over 122 gigabytes of data in channels of the messenger app Telegram. Troy Hunt is the operator of Have-I-been-pwned, a database for leaked login data. This includes 361 million email addresses, almost half of which have apparently never appeared in such a data leak before. Usernames and passwords for online accounts were also part of the leak. Cybersecurity experts have collected these login data from several Telegram channels. In these channels, used by cybercriminals, stolen data is distributed in order to improve the reputation of the channel and gain subscribers. The information posted is most likely genuine to a large extent.
What is important now
"Telegram is often used as an open, app-based dark forum where user data and illegal material are exchanged. It shares many characteristics with the dark web in terms of anonymity and also attracts cybercriminals for malicious activities," explains ESET IT security expert Jake Moore about the case.
"Usernames and passwords are often stolen using infostealer malware that cybercriminals use to infect computers. Having strong and up-to-date malware protection is therefore essential," advises Moore.
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a monthOther concrete tips for users are:
- Check your data: On the page Have I been pwned? Users can determine whether their email addresses and passwords were already affected by the current or a previous leak.
- Watch out for spam messages: If your data is already in circulation, users should be particularly careful in the near future: the collected email addresses are often used for spam campaigns.
- Change existing passwords: Hackers will use the stolen login data to access various accounts. Experts call this credential stuffing. Above all, users should use a unique, secure password for each account.
- Set up two-factor authentication: As soon as another factor – such as a smartphone app – is used in addition to the user name and password, cyber criminals can no longer easily access online accounts if they get hold of login data.
About ESET ESET is a European company with headquarters in Bratislava (Slovakia). ESET has been developing award-winning security software since 1987 that has already helped over 100 million users enjoy secure technology. The broad portfolio of security products covers all common platforms and offers companies and consumers worldwide the perfect balance between performance and proactive protection. The company has a global sales network in over 180 countries and branches in Jena, San Diego, Singapore and Buenos Aires. For more information, visit www.eset.de or follow us on LinkedIn, Facebook and Twitter.