 Hey guys, it's Neil Iffenberg, I'm here with Russell Brandom. We're talking about the hack of the century. What is the hack of the century? Yeah, it's, okay, so it's 1.2 billion login password combinations, which is more than we've ever gotten in one bundle. The security firm called Hold Security has been tracking this group that they named Cybervor. Very spooky. It's a great name. And yeah, so through various methods, the Cybervor group had amassed 1.2 billion username password combinations. And the highest number before was like 700 million. Yeah, it was a lot lower. So I mean, that's why, you know, the number kind of gets your attention. We're up in the Bs, billion with a B, which is new. Right, and the New York Times had like a big exclusive yesterday. Yeah, yeah. Huge thing. But then there's immediately questions about whether this was true. Yeah. And you're saying it's not true. Well, I have my doubts. I mean, the biggest thing that immediately people had questions about was everyone wants to know if they're on the list. Like is it my login password combination? Hold Security, which had in fairness done all this work to uncover this stuff, said, well, if you're a subscriber, which means you give us $120 a year, then you can know if you're on the list. That seems super scammy. That's the thing. And so people were very uncomfortable with that, especially since it was this big exclusive in the New York Times. The New York Times certainly, I'm sure, didn't mean to just be driving all these people to hold security. So that felt a little weird. And then as you look more at the numbers, is this really a direct comparison to other hacks that we've seen before? Or is this just a kind of, did they just sort of get 1.2 billion names from various things? Some of them were theirs. We know that they had, as part of their earlier things, bought username password combinations, which is a thing that scammers do on the internet. So where did this really come from? Is it fair to call all of it a hack? Is it all 1.2 billion together? So the weird part is that it seems like there's this hacking group Cybervor, and then there's Hold Security. And Cybervor should be the villains, but it seems like Hold Security is doing some weird stuff to sort of turn themselves into the villains of the story. Yeah, well, I think part of it is that Cybervor aren't very scary, other than the name. But I mean, I think the name's sort of an example of it. So what are they using this for? They're not using it to break into my bank account. They're not selling it to other criminals, which is often a thing that happens. They're using it to hack Twitter accounts, which is not a particularly lucrative or frightening thing to do with this information. Well, it's scary for me, certainly. I mean, that's because you're verified. But I mean, no, it's just not, like, this isn't a very sophisticated thing to do with this information. So that's kind of whatever. And then also the way that the method that they used, you know, SQL attacks have been known, but it's not really that sophisticated of a method. So if you have this unprecedented hack, which $1.2 billion is certainly unprecedented, you expect them to be using unprecedented methods that, like, these people did something really cool. Like with Target, they were hacking the air conditioning company. It's like the electronic version of, like, crawling in through the air vents. It was this cool thing, and they got in this way that no one had really thought about before. There's no real equivalent of that. They just did this thing that... They just collected a bunch of stuff and maybe hacked some other stuff. Well, and yeah, I mean, they looked over a lot of sites to see who was vulnerable for this, but this is a known vulnerability. So it's just sort of the scale of it is different. It's kind of quantity over quality. But isn't that, like, actually known vulnerabilities being propagated in lots of places? It's kind of like a big story that has gone a little bit under-reported, right? Yeah, absolutely. And it does seem like these people really did hack a lot of... They hacked a lot of people, certainly. I think it does seem the more you look at it that those were maybe small firms who weren't very good at security and sort of maybe these were not high-value username passwords in the way that, like, I use a really complicated one for my bank account and, like, my Snapchat password is a little less high-pri. The thing is... It almost seems like there should be the other way around. That's true. I have insurance on the bank. Snapchat is just my reputation. It can't get it back. So bottom line, I mean, is this scary? I mean, it's the hack of the century, but it is the hack of the century. I think most people just want to know, is my stuff going to be safe? What steps can I take? What's sort of the next... What's the next frontier of terrifying things happening on the Internet? I mean, you should be incredibly scared all of the time. The Internet's terrible. No, we always say, like, change your passwords, use a password manager. Don't duplicate the passwords across multiple things, which is multiple services, which is... I mean, that's, like, the number one advice. Don't use the same username and password. Which is exactly what they're trying to do here. I mean, that's the attack they're doing. But if your name is one of the 1.2 billion names, which just statistically, if you're living on Earth, the odds are high, it doesn't really matter. Like, they're going to hack your Twitter, maybe, if you use... If you duplicate that, but, like, who cares? I think people care if they hack their Twitter. Yeah, but I mean, it's just not, like... So this is one of those moments where you should change your password. Like, bottom line, this is one... I guess, but, like, I mean, it's sort of not even, like, if your Twitter password was the same. But I just think even in the scale of hacks, like, if you had shopped a target, they would have your credit card information. This, it's, like, nothing. Like, it's just very... Right, it's just passive. Even if you're one of the people who's affected, it's sort of a low-impact thing, I think. It's just that the number's really high, so it's sort of more likely. So just continue living your life free of all danger and carefree. Yeah. And change your passwords.
 Hey guys, it's Neil Iffenberg, I'm here with Russell Brandom.
 We're talking about the hack of the century.
 What is the hack of the century?
 Yeah, it's, okay, so it's 1.2 billion login password combinations, which is more than
 we've ever gotten in one bundle.
 The security firm called Hold Security has been tracking this group that they named Cybervor.
 Very spooky.
 It's a great name.
 And yeah, so through various methods, the Cybervor group had amassed 1.2 billion username
 password combinations.
 And the highest number before was like 700 million.
 Yeah, it was a lot lower.
 So I mean, that's why, you know, the number kind of gets your attention.
 We're up in the Bs, billion with a B, which is new.
 Right, and the New York Times had like a big exclusive yesterday.
 Yeah, yeah.
 Huge thing.
 But then there's immediately questions about whether this was true.
 Yeah.
 And you're saying it's not true.
 Well, I have my doubts.
 I mean, the biggest thing that immediately people had questions about was everyone wants
 to know if they're on the list.
 Like is it my login password combination?
 Hold Security, which had in fairness done all this work to uncover this stuff, said,
 well, if you're a subscriber, which means you give us $120 a year, then you can know
 if you're on the list.
 That seems super scammy.
 That's the thing.
 And so people were very uncomfortable with that, especially since it was this big exclusive
 in the New York Times.
 The New York Times certainly, I'm sure, didn't mean to just be driving all these people to
 hold security.
 So that felt a little weird.
 And then as you look more at the numbers, is this really a direct comparison to other
 hacks that we've seen before?
 Or is this just a kind of, did they just sort of get 1.2 billion names from various things?
 Some of them were theirs.
 We know that they had, as part of their earlier things, bought username password combinations,
 which is a thing that scammers do on the internet.
 So where did this really come from?
 Is it fair to call all of it a hack?
 Is it all 1.2 billion together?
 So the weird part is that it seems like there's this hacking group Cybervor, and then there's
 Hold Security.
 And Cybervor should be the villains, but it seems like Hold Security is doing some weird
 stuff to sort of turn themselves into the villains of the story.
 Yeah, well, I think part of it is that Cybervor aren't very scary, other than the name.
 But I mean, I think the name's sort of an example of it.
 So what are they using this for?
 They're not using it to break into my bank account.
 They're not selling it to other criminals, which is often a thing that happens.
 They're using it to hack Twitter accounts, which is not a particularly lucrative or frightening
 thing to do with this information.
 Well, it's scary for me, certainly.
 I mean, that's because you're verified.
 But I mean, no, it's just not, like, this isn't a very sophisticated thing to do with
 this information.
 So that's kind of whatever.
 And then also the way that the method that they used, you know, SQL attacks have been
 known, but it's not really that sophisticated of a method.
 So if you have this unprecedented hack, which $1.2 billion is certainly unprecedented, you
 expect them to be using unprecedented methods that, like, these people did something really
 cool.
 Like with Target, they were hacking the air conditioning company.
 It's like the electronic version of, like, crawling in through the air vents.
 It was this cool thing, and they got in this way that no one had really thought about before.
 There's no real equivalent of that.
 They just did this thing that...
 They just collected a bunch of stuff and maybe hacked some other stuff.
 Well, and yeah, I mean, they looked over a lot of sites to see who was vulnerable for
 this, but this is a known vulnerability.
 So it's just sort of the scale of it is different.
 It's kind of quantity over quality.
 But isn't that, like, actually known vulnerabilities being propagated in lots of places?
 It's kind of like a big story that has gone a little bit under-reported, right?
 Yeah, absolutely.
 And it does seem like these people really did hack a lot of...
 They hacked a lot of people, certainly.
 I think it does seem the more you look at it that those were maybe small firms who weren't
 very good at security and sort of maybe these were not high-value username passwords in the
 way that, like, I use a really complicated one for my bank account and, like, my Snapchat
 password is a little less high-pri.
 The thing is...
 It almost seems like there should be the other way around.
 That's true.
 I have insurance on the bank.
 Snapchat is just my reputation.
 It can't get it back.
 So bottom line, I mean, is this scary?
 I mean, it's the hack of the century, but it is the hack of the century.
 I think most people just want to know, is my stuff going to be safe?
 What steps can I take?
 What's sort of the next...
 What's the next frontier of terrifying things happening on the Internet?
 I mean, you should be incredibly scared all of the time.
 The Internet's terrible.
 No, we always say, like, change your passwords, use a password manager.
 Don't duplicate the passwords across multiple things, which is multiple services, which
 is...
 I mean, that's, like, the number one advice.
 Don't use the same username and password.
 Which is exactly what they're trying to do here.
 I mean, that's the attack they're doing.
 But if your name is one of the 1.2 billion names, which just statistically, if you're
 living on Earth, the odds are high, it doesn't really matter.
 Like, they're going to hack your Twitter, maybe, if you use...
 If you duplicate that, but, like, who cares?
 I think people care if they hack their Twitter.
 Yeah, but I mean, it's just not, like...
 So this is one of those moments where you should change your password.
 Like, bottom line, this is one...
 I guess, but, like, I mean, it's sort of not even, like, if your Twitter password was the
 same.
 But I just think even in the scale of hacks, like, if you had shopped a target, they would
 have your credit card information.
 This, it's, like, nothing.
 Like, it's just very...
 Right, it's just passive.
 Even if you're one of the people who's affected, it's sort of a low-impact thing, I think.
 It's just that the number's really high, so it's sort of more likely.
 So just continue living your life free of all danger and carefree.
 Yeah.
 And change your passwords.