Anti Public Combo List Exposes 458 Million Email‑Password Pairs
What Happened — In December 2016 a publicly‑circulated “combo list” named Anti Public contained 458 million unique email addresses paired with passwords harvested from multiple online services. The list has been widely used for credential‑stuffing attacks.
Why It Matters for Trust & Control Assurance —
- Credential reuse across services creates a single point of failure; continuous monitoring of exposed credentials is a core control‑assurance activity.
- Demonstrates the necessity of strong identity and access management (IAM) controls—MFA, password hygiene, and detection of credential‑stuffing attempts.
- Aligns with the control objective of Access Management & Credential Protection and is best addressed through our Access Controls capability.
Who Is Affected — Any organization whose users reuse passwords—spanning finance, SaaS, retail, health, and more.
Recommended Actions —
- Enforce multi‑factor authentication for all privileged and high‑risk accounts.
- Deploy credential‑monitoring services (e.g., breach‑alert feeds) to detect exposed passwords.
- Review and tighten password policies, including complexity and rotation.
- Update incident‑response playbooks to include credential‑stuffing detection and mitigation. Source: https://haveibeenpwned.com/api/v3/breach/AntiPublic
Technical Notes — Attack vector: credential stuffing using stolen email/password pairs. Data types exposed: email addresses, passwords. Source: https://haveibeenpwned.com/api/v3/breach/AntiPublic