UK govt shares 585 million passwords with Have I Been Pwned

The United Kingdom’s National Crime Agency has contributed more than 585 million passwords to the Have I Been Pwned service that lets users check if their login information has leaked online.

Just like with the passwords coming from the FBI, this massive collection has been added to the Pwned Passwords data that allows searching if a password has been compromised.

NCA’s password collection comes from the agency’s National Cyber Crime Unit (NCCU), gathered during investigations of cybersecurity incidents.

Troy Hunt, the creator of the Have I Been Pwned (HIBP) service, announced today that after importing and parsing the data from the NCA a set of 225,665,425 passwords were found to be completely new.

Even if less than half the NCA password collection was added to the live Pwned Passwords data, it still makes for a significant contribution, Hunt says in a blog post today.

HIBP’s Pwned Passwords project lets law enforcement agencies in multiple countries add passwords found during investigations. Thus, other services using the Pwned Passwords API can protect their users against account takeover attacks.

The NCA told Hunt that the source of the passwords was a cloud storage location belonging to a UK business that unidentified actors were using to deposit compromised login data.

The investigators realized that the credentials came from multiple data breaches and that third parties could access them “to commit further fraud or cyber offences.”

With NCA’s recent contribution, the number of credentials in the Pwned Passwords service increased by 38%, to more than 847 million.