In 2014, Milwaukee-based security firm Hold Security alleged that a small Russian-speaking group it named “CyberVor” had obtained more than 1.2 billion internet usernames and passwords, along with hundreds of millions of associated email addresses. Hold claimed that approximately 420,000 websites were affected and said the attackers used SQL injection against some targets. It also said the dataset included credentials acquired from other sources, making the precise scope and method unclear. The alleged theft posed a serious account-takeover and password-reuse risk, but the source does not identify the affected websites or the individuals responsible.
The report became widely known after coverage by The New York Times, but no named independent sources publicly confirmed the breach. Forbes writers Kashmir Hill and Joseph Steinberg questioned both the evidence and the incentives behind the claims. Hold offered website owners a credential-checking service for $10 per month and a consumer lookup requiring users to submit encrypted versions of their passwords, creating additional controversy over privacy and commercialization. Because the central allegations were not independently verified, the incident remains an unverified breach claim rather than an established enforcement finding or confirmed criminal case.
