In January 2019, security researcher Troy Hunt, founder of Have I Been Pwned?, identified Collection No. 1 after it was briefly uploaded to the file-sharing service Mega and circulated through a hacker forum. The cache contained 87 gigabytes across roughly 12,000 files, including more than 773 million unique email addresses, 21 million unique passwords, and over 2.7 billion email/password combinations. Researchers found data from more than 2,000 earlier breaches, alongside an estimated 140 million previously unseen addresses and 10 million new passwords.
The exposure was especially dangerous because many passwords were available in plaintext rather than only as cryptographic hashes, indicating that weak hashing implementations had been cracked. Unlike credential lists typically sold on criminal markets, Collection No. 1 was temporarily available at no cost, expanding its potential user base and enabling credential stuffing against unrelated services where people had reused passwords. By January 30, 2019, Collections No. 2 through No. 5 had also surfaced, totaling about 845 gigabytes and 25 billion records before deduplication. Threat-intelligence firm IntSights attributed the compilation to a hacker known as Sanix and the leak to rival broker Azatej; both were arrested in May 2020, in Ukraine and Poland respectively.
