close

News WrapGet Handpicked Stories from our editors directly to your mailbox

Remember hacker who stole 600 mn a/c details? This time breaks nto 127 mn more records

According to the hacker's listings, Ixigo used an outdated "MD5" hashing algorithm to scramble passwords, which these days is easy to unscramble.   

Remember hacker who stole 600 mn a/c details? This time breaks nto 127 mn more records
Hacker who stole close to 620 million user records from 16 websites has struck again, Photo: Pixabay
By IANS
Updated: Fri, Feb 15, 2019
07:06 pm
San Francisco, IANS
RELATED NEWS
Chinese hackers hit 27 varsities in US, Canada to steal military research: Report Chinese hackers hit 27 varsities in US, Canada to steal military research: Report
Hacker who stole data of 750 million users now puts 93 million hacked databases for sale Hacker who stole data of 750 million users now puts 93 million hacked databases for sale
Uber paid 20-year-old Florida man to keep data breach secret: Sources Uber paid 20-year-old Florida man to keep data breach secret: Sources

A hacker who stole close to 620 million user records from 16 websites has struck again, this time breaking into 127 million more records from eight more websites.

According to a TechCrunch report late on Thursday, the hacker now has 18 million user records from travel booking site Ixigo and 40 million from live-video streaming site YouNow.

"Houzz, which recently disclosed a data breach, is listed with 57 million records stolen and Ge.tt had 1.8 million accounts stolen," said the report.

According to the hacker's listings, Ixigo used an outdated "MD5" hashing algorithm to scramble passwords, which these days is easy to unscramble. 

"YouNow doesn't store passwords," a spokesperson was quoted as saying.

In a statement to IANS, Ixigo said it is currently investigating this alleged security breach. 

"We are a travel marketplace and we take our users data and privacy seriously. We do not store payment, cards or financial information for any of our users," said a company spokesperson. 

"We encrypt and hash our passwords with a one-way hashing algorithm. While we have already taken pre-emptive security measures such as two-factor authentication, we will also, as a precaution, reset passwords and security tokens of our users," the spokesperson added.

Watch Zee Business Tweet video here:

Earlier, the same hacker claimed he had user records from several major sites like more than 151 million records from MyFitnessPal and 25 million records from Animoto. 

It has been claimed that databases, which are aimed at making "life easier" for hackers, can be purchased from the Dream Market cyber-souk, located in the Tor network, for less than $20,000 in bitcoin. 

The stolen information mainly includes account holders' names, email addresses and passwords, according to the report that appeared this week.

The price appears to be relatively cheap because the information is targeted at spammers and credential stuffers who could use the information to also get access to other sites for which the users use the same usernames and passwords.

While some of these websites - particularly MyHeritage, MyFitnessPal and Animoto - warned their customers last year that they had been compromised, several others have started notifying users about the hacks.