Millions of Twitter access credentials have made their way to the dark web and are currently being offered for sale, according to reports Wednesday.

How many accounts have been compromised is not clear; ZDNet reports that the Russian hacker, who goes by the name Tessa88, is claiming to have 379 million records, but a later report from leak search engine Leaked Source puts the figure at 32.88 million.

How the data was gathered is not clear at this stage either: LeakedSource speculates that the usernames and passwords may have been gathered using malware.

“The explanation for this is that tens of millions of people have become infected by malware, and the malware sent every saved username and password from browsers like Chrome and Firefox back to the hackers from all websites including Twitter,” the company suggested.

Adding to the suggestion that the source of the data is malware, the passwords in the file are said to be in plain text with no encryption or hashing; Twitter did not store passwords is plaintext at the time the data was taken, believed to have been at some point in 2014.

SiliconANGLE is unable to verify whether the data is accurate, however, ZDNet claims to have been able to verify it with a number of its employee’s details.

Twitter said in a statement that they have not been hacked, saying in a statement: “We are confident that these usernames and credentials were not obtained by a Twitter data breach – our systems have not been breached. In fact, we’ve been working to help keep accounts protected by checking our data against what’s been shared from recent other password leaks.”

Again

No matter how the data was obtained, it’s yet again another day, another case of data leaking from a major company, with recent examples including LinkedIn, Tumblr, and MySpace.

There’s little point in going over what has been said before about these hacks, but what is revealing is how some people really don’t take their security seriously; according to LeakedSource, the most popular passwords in the Twitter data were 123456, qwerty and password.

In 2016 you’d think people would know better.

If you’re concerned that your Twitter details are available in the file, search using your username on LeakedSource here.

Image credit: Twitter.