mail.ru Dump Data Breach

What happened

In September 2014, several large dumps of user accounts appeared on the Russian Bitcoin Security Forum including one with nearly 5M email addresses and passwords, predominantly on the mail.ru domain. Whilst unlikely to be the result of a direct attack against mail.ru, the credentials were confirmed by many as legitimate for other services they had subscribed to. Further data allegedly valid for mail.ru and containing email addresses and plain text passwords was added in January 2018 bringing to total to more than 16M records. The incident was also then flagged as "unverified", a concept that was introduced after the initial data load in 2014.

Exposed data

Recommended actions

• Change your mail.ru Dump password immediately, and update it anywhere you reused the same password.
• Enable two-factor authentication on the affected account and on your critical services (email, banking).
• Watch for targeted phishing emails referencing mail.ru Dump — attackers weaponise breach data quickly.
• Check whether your email address appears in this breach on haveibeenpwned.com.