US-based cyber security firm Hold Security has said it recovered over 88,000 accounts with .sg domain names which were stolen by a Russian hacker.
It has been informed that out of those 88,000 accounts, 61,000 belonged to yahoo.com.sg, 8,000 were from singnet.com.sg and 3,600 were from .edu.sg, while about 1,100 from ntu.edu.sg and 1,400 from nus.edu.sg.
Hold Security's founder and chief information security officer, Alex Holden, said the credentials do not always belong to the e-mail providers. "Many services require you to use your e-mail address as a user ID, hence a breach in such service may produce a record of e-mail/password similar to (your) e-mail credentials," he added.
Holden said the information which was obtained by the hacker may or may not have been used for malicious activity, depending on what was breached. He said: "Most accounts never get fully compromised. However, if you lose your bank details, the chances are rather high that this information would be abused."
The company's recovery team had spotted a young Russian hacker bragging in an online forum about the millions of stolen accounts that he had collected. The hacker claimed he could give away a total of 1.17 billion stolen credentials, including duplicate accounts.
A majority of these stolen accounts appeared to be from Russia, but there were quite a big number of accounts from Germany and China as well.
The stolen accounts include tens of millions of accounts from all three major e-mail providers: Gmail, Microsoft and Yahoo.
This was one of the biggest stashes of stolen credentials which has been discovered since cyber attacks hit major US banks and retailers two years ago, Reuters reported.
If you wish to check, if you have an account that was uncovered as a part of any data breach, visit haveibeenpwned.com. The website also has a list of websites with databases that have been compromised.
Ryan Flores, senior manager of cyber security firm Trend Micro, said that if you feel that your account has been hacked by someone, the first thing you should do is to change the password to something which is difficult to guess.
Singapore's Cyber Security Agency (CSA) has said it encourages users to sign up at the CSA's SingCERT webpage for all kinds of alerts and advisories on the latest cyber security news in Singapore.
