VK.com Data Breach Includes 100 Million Cleartext Passwords

A hacker has put up for sale 100,544,934 records he claims were stolen from VK.com, a Russian-based social network. This is the same hacker who had previously sold data dumps from MySpace, LinkedIn, Tumblr, and Fling.com.

Named Peace (or Peace_of_mind), the hacker is asking for 1 Bitcoin (~$570) for the entire dataset, which is available for sale on The Real Deal Dark Web marketplace.

Data breach search engine service LeakedSource has got hold of the data from one of the people who bought it. The company has analyzed the dump's contents and has added it to its service. Users can use their search engine and see if their data was compromised.

VK.com stored passwords in cleartext

According to the company's experts, the data dump contains information such as email addresses, first name, last name, location information, phone numbers, sometimes a secondary email, and in all cases a cleartext password.

As of now, nobody knows when VK.com was hacked and this data stolen, but if VK.com still stores passwords in cleartext today, this should be a warning sign for its users.

All the LinkedIn, MySpace, and Tumblr breaches are believed to have taken place between 2012 and 2013, when some sites did not practice up-to-par Web security policies, such as hashing and salting passwords.

Below is a breakdown of the leaked data, with a list of top 25 most popular passwords, top 25 most popular email domains, and a screenshot of Peace's VK.com listing.  

VK.com listing on the Dark Web