A look at rival hackers Tessa88 and Peace who claim to have millions of hacked credentials not yet put up for sale, from Facebook, Instagram, and more
Three major social networks have quietly fallen victim to data breaches, but despite some high-profile success, patience and trust is now beginning to fade.
Context & Ripple Effects
This lands mid-arc in a busy spring for credential theft: the hacker behind LinkedIn's 117M-email database had just claimed 360M Myspace user emails with passwords, and days later gave an interview describing $25K earned in a single month selling LinkedIn, MySpace and Tumblr data while holding a billion site logins back. What is new here is the rivalry: Tessa88 and Peace are competing sellers claiming overlapping stashes of Facebook and Instagram credentials, none of it yet listed.
The competition matters because these hackers sell on reputation — buyers pay for proven, unexpired data — and the ZDNet reporting notes patience and trust between them is already fraying. That dynamic, not the raw counts, is what shapes what happens next.
First-order effects
- Facebook and Instagram account holders face immediate credential-stuffing exposure the moment either seller lists the claimed troves, since reused passwords turn one social-network breach into access elsewhere.
- Buyers in the stolen-data market must now vet two rival suppliers claiming similar inventory, making authenticity — not scarcity — the binding constraint on any sale.
Second-order effects
- The platforms named face pressure to force mass password resets and tighten authentication ahead of any listing, since a public sale converts a private stash into a working attack kit overnight.
- A price war or credibility fight between Tessa88 and Peace could push one to dump inventory cheaply to prove legitimacy, flooding the market and undercutting the drip-release pricing that made Peace's monthly sales pace possible.
Third-order effects
- If the broker model holds, stolen credentials consolidate into held inventories released over years rather than one-off leaks — a pattern the corpus bears out when a later sale aggregated roughly 617M account details from 16 hacked companies on the dark web.
- Sustained multi-year monetization of old breaches shifts platform security economics toward assuming credentials are permanently compromised, favoring defenses that do not depend on password secrecy.
The trend: Stolen-credential selling is consolidating around rival broker-hackers who hold large inventories and release them gradually, turning breaches into long-tail revenue streams rather than single events.