Collection #1 data breach: what happened and what to do
In January 2019, a collection of credential stuffing lists was found being distributed online. It held 773 million unique email addresses and passwords those addresses had used on other breached services.
View all 13,115 breaches- Breach date
- 7 Jan 2019
- Affected
- 772,904,991
- Data exposed
- Email addresses, Passwords
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Collection #1 isn't one company's breach. In January 2019, a large set of credential stuffing lists was found being distributed on a hacking forum. Credential stuffing lists are combinations of email addresses and passwords gathered from other breaches, used to hijack accounts on other services.
Have I Been Pwned (HIBP) loaded the data on 16 January 2019. It held almost 2.7 billion records, including 773 million unique email addresses (772,904,991, to be precise), alongside passwords those addresses had used on other breached services. HIBP flags this one as unverified, because there is no single source company to confirm it. The data was a compilation of older leaks, so many entries were years old.
What was exposed
Email addresses and passwords. The passwords were in plain text, which is why this set became so useful to criminals.
If your email is listed, it means one or more of your passwords, from some earlier breach, was in the file. You may not know which one. The point is that those passwords are now known to be public, so you should not be using them anywhere.
Why it matters
Reusing passwords is how a leak from a small forum can turn into a stolen email account. An attacker takes a pair from a list like this and tries it on your email, your bank and your social accounts, automatically and in bulk. A single match is enough.
What to do
There is nothing to ask a company to delete here, because no company holds the file. The useful response is to remove your own risk: use a different password on each site, and add a second step that a leaked password alone can't get past.
What to do if you were in it
- 1
Check which passwords you have reused
If your email is in Collection #1, assume every old password tied to it is known. Change any that you still use, starting with email and banking.
- 2
Use a unique password everywhere
A password manager creates and stores a different long password for each site, so one leak can't open others.
- 3
Turn on two-factor authentication
With 2FA on, a stolen password alone isn't enough to log in. Use an authenticator app or a security key where possible.
- 4
Watch for phishing
Your email address is public in this list. Be careful with messages that claim to be from your bank or an account provider.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It looks for your email and phone number in breach databases and on the dark web, and alerts you if they show up. Breach data can't be taken down, so the scan tells you what to change instead.
Frequently asked
Was I in Collection #1?
Search your email on Have I Been Pwned. If Collection #1 is listed, your address and a password it used elsewhere were in the data.
What was exposed?
Email addresses and passwords, taken from other breaches. HIBP counted 772,904,991 unique email addresses.
Which company was breached?
None in particular. It was a compilation of credential stuffing lists, so HIBP lists it as unverified.
Should I change my password?
Yes. Change any password you have reused, and use a different one on every site.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
