Earlier this month, security guru Troy Hunt added a staggering two billion unique email addresses and 1.3 billion unique passwords to his Have I Been Pwned and Pwned Passwords databases. Aggregated by Synthient , the data comes from multiple credential stuffing sources shared by threat actors, as well as data stolen directly from individuals through infostealer malware.

The number of people affected is so massive that the rollout of notifications went out in waves to Have I Been Pwned subscribers. (This service is free—enter your email address into the HIBP search field, and then click on the Notify Me button that appears before any results.)

The data also has particular characteristics that stood out to me. (You can read more about them in Hunt’s blog post .)

Between these de

See Full Page