More than a quarter of a million email accounts on the biggest webmail services are believed to be at risk from online criminals after thousands of passwords belonging to users of the Yahoo, AOL and Gmail services were posted online.
The breach, likely to be the accumulation of a number of separate phishing attacks using fake sites to lure people to leave login details, is believed to be one of the biggest of its kind.
Graham Cluley, a consultant for the security company Sophos, said: “The danger is that people will be using the same password on many different sites, so the criminals will go and try them on Amazon or PayPal or wherever.”
Users of those services, and of Microsoft‘s Hotmail service, are being urged to change their passwords and the security question they use as a precaution.
The discovery comes after 10,000 passwords belonging to Hotmail users with accounts beginning with A or B were found posted online over the weekend. That list suggests there could be about 130,000 compromised Hotmail accounts in all, from its total of 250m.
It emerged today that Yahoo, the biggest online email provider, with about 260m users, Google’s Gmail, with about 100m users, and AOL, with 50m, have also been targeted. If the proportion of successful phishing attacks on those users is similar to those affected on Hotmail, more than 250,000 account details would have been captured.
Phishing uses emails with credible-looking web links which lure the reader to click on them and enter personal details. Some masquerade as coming from banks or PayPal, for example, and take the user to fake sites that use the same images as the genuine ones. There they are asked to enter personal information, which can be used to log in to the original email account, and take control of it and other services that use the same details.
Tom Warren, a writer at Neowin.net, which discovered the breaches, noted that many of the Hotmail passwords seemed to come from Europe, suggesting that British users could be substantially affected.
Content courtesy of The Guardian
https://www.guardian.co.uk/technology/2009/oct/06/gmail-yahoo-aol-phishing-scam