Over 100M records from Russian social media site VK, with unencrypted passwords, names, emails, and phone numbers, on sale by hacker named Peace for 1 bitcoin
Accounts for over 100 million users of popular social media site VK.com are being traded on the digital underground.
Context & Ripple Effects
The VK sale is the latest entry in a 2016 wave of Russian-web credential dumps hitting the underground. Weeks earlier, Hold Security-linked reporting flagged 272.3 million email credentials — 57M Mail.ru, 40M Yahoo, 33M Hotmail, 24M Gmail — circulating among the same Russian-speaking traders, and the seller here, Peace, had already listed an alleged 200M+ account Yahoo dump from 2012 for 3 bitcoin.
What distinguishes the VK lot is its completeness and storage failure: alongside emails it carries names, phone numbers, and passwords kept unencrypted, making it less a breach artifact than a ready-made identity kit. It also previews the pipeline behind Russia's maturing retail market for leaked personal data, where records eventually sell for pocket change.
First-order effects
- Over 100 million VK users have their name, email, phone number, and working password exposed simultaneously, giving buyers direct account access rather than just hashes to crack.
- VK faces immediate pressure to force password resets and harden authentication, since the plaintext passwords mean no cracking step stands between purchase and takeover.
Second-order effects
- Password reuse turns the dump into ammunition against every other service those 100 million users signed up for, extending the blast radius well beyond VK itself.
- The 1-bitcoin asking price — cheaper per record than Peace's 3-BTC Yahoo lot despite being fresher — signals credential dumps becoming a commoditized, volume-priced category rather than bespoke stolen goods.
Third-order effects
- A pattern of major Russian services holding passwords in recoverable form points to systemic storage-practice failure across that ecosystem, not isolated incidents like the separate Rambler.ru plaintext leak.
- If dumps keep flowing from the same small seller pool, attribution and tracking efforts of the kind Alex Holden pioneered against the 1.2B-credential theft become the main lever platforms and investigators have left.
The trend: Breaches of Russian-language web services are surfacing years late as a standardized commodity market, with a handful of sellers like Peace setting volume prices on complete identity kits.