A List of 773 Million Email Addresses

What was made public this week

This week, the Have I Been Pwned service publicised a huge compilation of email addresses and passwords: about 773 million unique addresses and about 21 million unique passwords.

It is not a new breach. It was assembled from many older ones, some of them years old, gathered into one set of files and passed around on a hacking forum.

Lists like this are traded because they work. Not against the sites that were breached in the first place, but against every other account where somebody reused the same password.

So for a business, the question is not really whether an address is on the list. Plenty are. It is whether any password on it still opens anything.

How old passwords get used

The technique is called credential stuffing. Software takes each pair of email address and password from a list and tries it, automatically, against email providers, banks, shops and anything else with a login.

It does not need to be clever. If somebody used the same password for an old forum account and for their work email, the pair leaked from the forum opens the email.

The attempts cost almost nothing and run at enormous scale, so nobody has to pick out your business for it to be caught.

What a reused password opens

• The business email, which resets the password of everything else.
• The domain registrar, which decides where your website and email point.
• Hosting and the website's login, where the site itself can be changed.
• Online banking and the payment processor behind your shop or terminal.
• Supplier portals, where orders and account details sit.
• Social pages, run through personal profiles with passwords of their own.

The first is the one that matters most. Whoever can read your email can request a password reset on every other account on this list, and receive it.

Checking the business's addresses

Have I Been Pwned lets anyone search for an email address and see which known breaches it has appeared in. It is free, and it does not ask for a password.

Check every address the business uses: the general inbox, each person's work address, and any personal addresses staff use for business accounts.

Domain owners can also verify their domain and see every address on it that appears in the data, with alerts for future breaches.

There is no need to type a password anywhere to act on this. Any password that has been used on more than one account should be treated as already known.

Reading the result

A match means the address appeared in at least one earlier breach. It does not mean your account was broken into, and any password leaked with it may be years out of date.

What matters is whether that old password, or anything close to it, is still in use. A password changed by adding a number to the end is the same password to the software trying them.

No match is not a clean bill of health either. The service holds only what has been found and published; plenty more has not been.

The three accounts to change first

Start with email. It holds the keys to everything else, so it gets a new, unique password before anything else is touched.

Then the domain registrar. Whoever controls it can point your website and email somewhere else, or move the domain away, which is slow and painful to undo.

Then banking, and anything else that moves money, such as the payment processor. Banks add checks of their own, but your banking password should still be one that has never been used anywhere else.

After those three, work through every other account that shared a password with them.

A worked example

The owner of a family-run hardware store checked his address after hearing the news. It appeared in three old breaches, including one from a fishing forum he had not visited in years.

The password he had used there was the one he had used for the store's email since 2012, and for a supplier's ordering portal.

Nothing seemed wrong. But the email account had a forwarding rule he had never created, quietly sending a copy of any message mentioning invoices to an address he did not recognise.

He changed the email password first, then deleted the rule and checked that the recovery phone number and backup address were still his.

The registrar, the bank and the supplier portal came next, each with a new password from a password manager. The incident went into the store's breach log, and supplier payment changes are now confirmed by phone.

After the first three

Every other account that shared the password comes next, in order of what it could cost you.

This is where a password manager earns its place. It creates a different long password for every account and remembers them all, so the only one anybody has to remember is the manager's own.

For the accounts that matter most, add two-step login, which asks for a code from your phone as well, so a leaked password cannot open the account by itself.

The emails that follow news like this

News of a big breach is always followed by emails trying to exploit it.

Some pose as security alerts and ask you to click a link and confirm your password. Go to the account directly instead, by typing its address or using a bookmark.

Others quote one of your old passwords and demand payment, claiming to have been inside your computer. They have not.

The password came from a list like this one. Delete the email, and change that password wherever it is still in use.

The counter-case

For some businesses there is very little to do.

If every account already has its own password, kept in a password manager, an address on this list is old news. Check the addresses, confirm nothing was reused, and move on.

And an address that appears only in breaches of services closed years ago, with a password never used since, is a record of history rather than a live risk.

Everyone else should assume the old passwords are known, and change the important ones first.

Today

1. Check every business address on Have I Been Pwned.
2. List every password used on more than one account.
3. Change the email password first.
4. Then the registrar and the bank.
5. Check email forwarding rules and recovery details.
6. Move passwords into a password manager.
7. Turn on two-step login for email.

Step five is the one most people skip. Somebody who got into an email account once may have left a forwarding rule behind, and it keeps copying mail long after the password changes.

Knowing which accounts exist in the first place is covered in every login your website depends on.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.