2014 mail — Have I Been Pwned verified incident: mail.ru Dump

In September 2014, several large dumps of user accounts appeared on the Russian Bitcoin Security Forum including one with nearly 5M email addresses and passwords, predominantly on the mail.ru domain. Whilst unlikely to be the result of a direct attack against mail.ru , the credentials were confirmed by many as legitimate for other services they had subscribed to. Further data allegedly valid for mail.ru and containing email addresses and plain text passwords was added in January 2018 bringing to total to more than 16M records. The incident was also then flagged as "unverified", a concept that was introduced after the initial data load in 2014 . BreachHistory indexes the Have I Been Pwned (HIBP) corpus for third-party breach disclosure and victim notification context; treat record counts and fields as disclosed in that source at time of indexing.