Russian hackers steal more than 1 billion Internet credentials

It’s time to change your passwords. Again.

In just a matter of months, a Russian crime ring has apparently managed to steal 1.2 billion Internet passwords and 500 million email addresses — the largest known collection of stolen data — according to the The New York Times. Hold Security, a cyber security firm in Milwaukee, discovered the massive breach of approximately 420,000 websites.

The reported break-ins are the latest incidents to raise doubts about the security measures that big and small companies use to protect people's information online.

Security experts believe hackers will continue breaking into computer networks unless companies become more vigilant.

"Companies that rely on usernames and passwords have to develop a sense of urgency about changing this," Avivah Litan, a security analyst at the research firm Gartner, told the Times.

Retailer Target is still struggling to win back its shoppers' trust after hackers believed to be attacking from eastern Europe stole 40 million credit card numbers and 70 million addresses, phone numbers and other personal information last winter.

The 500 million email addresses mentioned in the Times' investigation could potentially be used help the hackers engineer other crimes, according to Hold Security, but so far they are only being used to send marketing pitches, schemes and other junk messages on social networks, the newspaper said.

Little of the information stolen appears to have been sold to other online crooks, according to the Times.

The breadth of the hack should serve as a chilling reminder of the skulduggery that has been going undetected on the Internet for years, said John Prisco, CEO of another security firm, Triumfant.

"This issue reminds me of an iceberg, where 90 percent of it is actually underwater," Prisco said in an email to The Associated Press. "That's what is going on here ... So many cyber breaches today are not actually reported, oftentimes because companies are losing information and they are not even aware of it."

Hold Security declined to identify the sites that were breached, citing nondisclosure agreements and concerns that they remained vulnerable to attack, the Times reported.

"Hackers did not just target U.S. companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites. And most of these sites are still vulnerable," Alex Holden, founder of Hold Security, told the paper.

Dmitri Alperovitch, chief technology officer of the cyber security firm CrowdStrike told Reuters that the stolen passwords could be used to access other accounts beyond the ones on sites that were breached because people commonly use the same passwords for multiple sites.

"A compromise like this could mushroom," said Alperovitch. 

Al Jazeera and wire services