Cybercriminals Trade 183 Million Stolen Credentials on Telegram, Dark Forums

SecurityWeek reports that researchers from cybersecurity firm Synthient have compiled a database of 183 million unique email addresses leaked across Telegram channels, dark forums and other online platforms, with most credentials linked to information-stealer malware rather than direct hacks of organisations. Of these, 16.4 million email addresses were not present in Have I Been Pwned’s previous data breaches, though the vast majority of the data had already appeared in the service’s records.

The dataset comprises 3.5 terabytes and 23 billion rows, including leaked email addresses, passwords and the sites they were used on; it originated from primary sellers of stolen information and aggregators who repost infostealer logs. Have I Been Pwned now makes the email addresses and their associated sites searchable, according to Troy Hunt.

The article also notes that Google dismissed reports of a Gmail security breach, and emphasises protections such as multi-factor authentication and passkeys, while KnowBe4 CISO advisor Erich Kron stresses the importance of password resets when large batches of leaked credentials emerge.