100 Million Rambler.ru Accounts Compromised in a 2012 Data Breach

The Russian Yahoo! Suffered a Massive Breach in 2012

A person by the nickname of daykalif seems to be in possession of a lot of sensitive data. On September 1, he contacted a data breach indexing service called LeakedSource and gave away information stolen during the 2012 attack on Last.fm. The leak contained usernames, passwords, and other details related to more than 43 million accounts. On September 8, daykalif gave security company HEROIC access to more than 33 million passwords stolen in 2011 from a Russian instant messaging service called QIP.ru. Because of the sheer number of affected users, experts called the attacks "mega breaches." They're nowhere near as "mega" as what happened to Rambler.ru, though.

On September 5, daykalif got in touch with LeakedSource again and leaked the usernames, passwords, and ICQ numbers of more than 98 million Rambler.ru users. The amount of stolen data is massive, which shouldn't really be a surprise considering the fact that many people call Rambler.ru the Russian Yahoo. What is rather shocking is how a mail provider as big as Rambler handles its security.

The breach itself isn't such a big worry. Anyone who has any idea about computer security knows that no one is safe out there. The hackers have become so creative nowadays, that even international corporations like Dropbox and LinkedIn who have close to half a billion users get compromised every now and then.

In most cases, companies that handle the data of so many people are aware of the fact that occasionally, a hacker might sneak inside the system, and they invest quite a lot of time and money into providing another layer of protection in case a breach does happen. Rambler didn't do that.

The Russian mail provider stored the passwords in plain text, which made users even more vulnerable to further attacks. If for example, a person has the same login details for his Rambler mail and his web banking application (not recommended by security experts), the repercussions could be quite severe.

What is even more worrying is that Rambler wasn't the only service that didn't hash or encrypt the passwords. The data stolen from QIP.ru showed that the instant messaging service also kept users' passphrases in plain text. VK.com, the popular social network that was hacked recently, did the same thing. In a better-late-than-never fashion, after the breaches, the compromised services urged users to change their passwords and implemented better protection of the sensitive data.

The hacked companies shouldn't take all the blame. After receiving the data, LeakedSource analyzed it and found out that back in 2012, users weren't employing exceptionally strong passwords. Predictable strings of characters like “123456”, “000000”, “666666”, and “654321” were among the most common passphrases found in Rambler's data dump. Fundamentally , if it weren't for the data breach, a worrying amount of people would have been sitting ducks for brute-force attacks.