Collection #1 Data Breach (2019): What Was Exposed & What To Do

In January 2019, a large compilation of email addresses and passwords known as Collection #1 was identified on a hacking forum. The material contained 2.7 billion records, including 773 million unique email addresses paired with passwords previously used on other services. Individuals whose details appeared in the collection face the practical risk that those credentials could be tested against accounts they hold elsewhere. The discovery was reported on January 7, 2019. No further information on the origin of the files or the method by which they were assembled has been disclosed.

Breaking down the breach

The reported incident involved 772.9 million people. The exposed data types named in available records are email addresses and passwords. The collection was described as credential-stuffing lists drawn from earlier incidents at other services. Public reporting provides no Reported Details on the timing of the underlying source breaches, the number of distinct source incidents, or the precise distribution method beyond its appearance on a forum.

How a breach like this happens

Collections of this type are typically formed by combining username and password pairs that have already appeared in separate data disclosures. Once aggregated, the lists can be shared or sold for automated testing against login pages on unrelated services. The process does not require new access to systems; it relies on the reuse of credentials across multiple sites and the continued circulation of older breach material.

About Collection #1

Collection #1 is the name given to the specific compilation of credential records identified in this case. Public detail on any organisation or individual responsible for assembling or distributing the files is limited to the fact that the material surfaced on a hacking forum. The data itself consists of information originally held by other online services.

What was likely exposed

The facts name email addresses and passwords as the data types present. Organisations that operate online services commonly store these two elements to manage user accounts. The exact scope of any additional fields or the complete list of source services remains unconfirmed.

The real-world impact

People whose email and password pairs appear in the collection may encounter repeated automated login attempts on services where they have used the same credentials. Services that do not enforce additional verification steps can be more exposed to these attempts. For the services whose data contributed to the collection, the main consequence is an increase in credential-testing traffic that must be filtered or blocked.

If your data was in this breach

Review account activity on services where you have used the affected email address. Change passwords on those services and avoid reusing them elsewhere. Enable any available multi-factor authentication options. Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other documented collections.

AICompiled with AI assistance from public sources and published under our editorial standards.