Two weeks after a massive database of nearly 773 million unique email addresses and 21 million plain text passwords was found online, the group behind the release has shared even more data, bringing the total pieces of data available to nearly 3 billion.

The new databases, Collections #2 through to #5, are being shared on hacker forums and file-sharing sites and are said to contain a total of 845 gigabytes of stolen data.

Like Collections #1, the data is believed to primarily be a collection of separate data breaches from the past. But the numbers are remarkable, with 25 billion total records and 2.2 billion unique usernames and passwords in the new databases. The databases are believed to include user data stolen in the successful hacks of Yahoo Inc., LinkedIn Inc. and Dropbox Inc., among others.

Notably, though, the new databases, like Collections #1 before it, include some stolen user credentials that have not been seen before in similar data breaches. This suggests that some of the data was obtained in more recent hacks that haven’t been indexed or made publicly available before.

“This is the biggest collection of breaches we’ve ever seen,” Chris Rouland, a cybersecurity researcher and founder of Phosphorus.io, told Wired Wednesday. “It’s an unprecedented amount of information and credentials that will eventually get out into the public domain.”

Distribution of the databases is also growing rapidly. Rouland said the files were being “seeded” by more than 130 people and that they had been downloaded more than 1,000 times as of yesterday.

Jacob Serpa, product marketing manager at Bitglass Inc., previously told SiliconANGLE that the whole affair reveals the failure of organizations to secure their data.

“Leaked credentials leave individuals vulnerable to account hijacking across all services where they recycle their usernames and passwords,” Serpa said. “Unfortunately, this includes the corporate accounts they use for work purposes, meaning that their employers are also put at risk by their careless behavior. Organizations must simultaneously defend their data against leakage and authenticate their users to ensure that they are who they say they are.”

For those concerned that their accounts may have been compromised, data in Collections #1 can be checked on Have I Been Pwned. The Hasso Plattner Institute also has a tool that can be used to check Collections #2 to #6.

Image: Pixabay