Feedback
Tech

FBI Has Lead in Probe of 1.2 Billion Stolen Web Credentials

Kaspersky on How to Catch a Hacker 1:40

A hacker who once advertised having access to user account information for websites like Facebook and Twitter has been linked through a Russian email address to the theft of a record 1.2 billion Internet credentials, the FBI said in court documents.

That hacker, known as "mr.grey," was identified based on data from a cybsecurity firm that announced in August 2014 that it had determined an alleged Russian crime ring was responsible for stealing information from more than 420,000 websites, the documents said.

The papers, made public last week by a federal court in Milwaukee, Wisconsin, provide a window into the Federal Bureau of Investigation's probe of what would amount to the largest collection of stolen user names and passwords.

Read More: Presidential John McAfee Talks Cybersecurity

The court papers were filed in support of a search warrant the FBI sought in December 2014 and that was executed a month later related to email records.

The FBI investigation was prompted by last year's announcement by Milwaukee-based cybersecurity firm Hold Security that it obtained information that a Russian hacker group it dubbed CyberVor had stolen the 1.2 billion credentials and more than 500 million email addresses.

The FBI subsequently found lists of domain names and utilities that investigators believe were used to send spam, the documents said.

The FBI also discovered an email address registered in 2010 contained in the spam utilities for a "mistergrey," documents show.

A search of Russian hacking forums by the FBI found posts by a "mr.grey," who in November 2011 wrote that if anyone wanted account information for users of Facebook, Twitter and Russian-based social network VK, he could locate the records.

Read More: Just How Did Those Russian Hackers Steal a Billion Passwords?

Alex Holden, Hold Security's chief information security officer, told Reuters this message indicated mr.grey likely operated or had access to a database that amassed stolen data from computers via malware and viruses. Facebook and Twitter declined comment.

The FBI declined to comment, and U.S. Justice Department had no immediate comment.