A look at rival hackers Tessa88 and Peace who claim to have millions of hacked credentials not yet put up for sale, from Facebook, Instagram, and more
Zack Whittaker / ZDNet :
Context & Ripple Effects
This story lands mid-arc: weeks earlier, the seller known as Peace claimed 360M MySpace emails with passwords after moving LinkedIn's 117M-record database, establishing that old breach data could be resold at scale. Now Zack Whittaker's reporting shows the market has a second seller — rival Tessa88 — and both are sitting on millions of Facebook and Instagram credentials they have not yet listed.
The withheld inventory is the news: days later, Peace told Wired about making $25K in a month selling LinkedIn, MySpace and Tumblr data while keeping a billion site logins unpublished. Unsold stock is now a deliberate strategy, not an accident.
First-order effects
- Facebook and Instagram users whose credentials sit in these unsold troves face immediate phishing and account-takeover risk before any public breach confirmation forces password resets.
- Peace gains a direct competitor in Tessa88, splitting demand among the same buyers of bulk login data.
Second-order effects
- Competition pushes sellers toward scarcity tactics — Peace's billion unpublished logins function as held-back inventory that can be drip-released to sustain prices rather than dumped at once.
- Platforms without a confirmed breach on record face pressure to act on unverified claims, weighing mass forced resets against the cost of ignoring credible stockpiles.
Third-order effects
- The pattern matures into standing inventory: by early 2019 a hacker had posted ~617M account details from 16 hacked companies for sale on the dark web, with MyHeritage and 500px confirming theft — hoarded credentials became a persistent commodity market rather than episodic leaks.
- If sellers keep monetizing years-old breach data across multiple platforms, the burden shifts to consumer-facing services to defend against credential reuse they never suffered themselves.
The trend: Stolen credential databases are turning from one-off leak events into a durable resale market, where competing sellers hoard inventory and time releases to protect pricing power.