RockYou2021: Massive data leak of passwords on the dark web

The issue of a data breach continues to plague the world of cybersecurity. What seems to be the most extensive password collection of all time has been leaked on the dark web. The source? An anonymous forum poster uploaded a 100GB TXT compilation file of stolen and leaked passwords, containing 8.4 billion entries. 

Here’s everything you need to know about the massive data leak “RockYou2021” and how to secure your data and avoid potential harm from threat actors.

What is RockYou2021?

RockYou2021 is dubbed as the mother of all password leaks! According to the reports, the forum user named the collection RockYou2021 in reference to the 2009 RockYou data breach, where 32 million leaked passwords had been stored in plaintext.

Considering that the total number of Internet users is estimated to be approximately 4.7 billion, the number of leaked credential data is staggering! The perpetrators likely possess multiple passwords used by millions of people.

As per security analysts who have examined the data breach, none of the leaked passwords is new but seems to have been compiled over several years. Many of the passwords in the file have been leaked in previous data breaches, including the Combination of Many Breaches in February 2021, which leaked 3.2 billion records online.

The person who uploaded this text file has claimed that all the passwords in the list are 6-20 characters long, and non-ASCII characters & white spaces have been removed. The person had also claimed that 82 million passwords had been leaked, but an investigation by security analysts has proved that it is actually ten times less. However, it remains the largest password and credentials leak of its kind in history.

Does it affect me?

The sheer scale of the number of leaked passwords, even the actual figure of 8.4 billion, is massive. A password you use could well be on the leaked list. Threat actors could use the credentials provided on the list to carry out credential stuffing attacks. So yes, if you are an Internet user with an online account, the RockYou2021 data breach could very well affect you.

With RockYou2021, hackers are looking to begin mass credential stuffing or more targeted credentials attacks. Given that your data was likely to be involved in this leak, you need to reset your passwords.

Tips to keep in mind to ensure the security of your account

• Check if your data has been leaked – Since the entire RockYou2021 password list contains data collected over many years, it is a good idea to check if any of your data, even if it is old, appears in the list. Many websites allow you to check if your password has been breached – you can click on this Quick Heal article for step-by-step instructions. However, ensure that you only use trusted and verified sites for this purpose – you don’t want to leak your password unintentionally! Change your password immediately and everywhere if your current password appears to have been breached.
• Change your passwords – Regardless of whether your password appears on this list, it is a good idea to change your online passwords. You never know when your password (or other credential data) could be leaked, so that is why it is a good habit to change your passwords regularly.
• Use hard and complex passwords – Changing passwords is a good habit, but it is not of much use if you use easily guessable passwords such as words from the dictionary, your name, or simply “password.” Use complex and challenging passwords, which are a combination of alphabets, numbers, and special characters.
• Use different passwords for different accounts – Using one password everywhere on the Internet is unsafe. You can create a very complex password, but you can still be the victim of a data breach. And if you use that breached password for all your online accounts, you could easily be exploited by a threat actor. So, use different complex passwords for other accounts, which will help you stay much safer on the Internet.
• Start using multi-factor authentication – The online world is moving away from its dependence on passwords, and you should too. If you have the option, enable multi-factor authentication in your online accounts to add an extra layer of security.
• Watch out for phishing attempts – As always, stay on your guard against unsolicited and suspicious calls, messages and emails. Don’t click on links unless you are sure where they will lead you to. Be very careful about how and where you use your data.
• Use robust Internet Security solutions – Stay safe on the Internet using Quick Heal Internet Security which offers the ultimate security for all your Internet needs. Access the Internet in peace as Quick Heal Internet’s Security large array of powerful features, including Safe Banking and Wi-Fi Scanner, proactively keep you safe online.

Now’s the perfect time to update your passwords and turn on MFA. We strongly encourage everyone to take the necessary measures to protect yourself from identity theft. Data breaches are all too common and we all have to stay vigilant.

Quickheal