RockYou leaked 32 million passwords in plain text

The story

RockYou was a company that made widgets and games for social networks. In December 2009, a hacker used a well-known type of website flaw, more than ten years old, to get into its database.

The database held more than 32 million user accounts. The passwords were stored in plain text, exactly as users had typed them, instead of in a scrambled form. Some records even included passwords for users’ accounts on other sites that RockYou apps connected to.

The full list of passwords was published online. For the first time, researchers could see in detail how ordinary people chose passwords: short numbers, names, simple words and keyboard patterns.

The list became a standard tool. Programs that try to guess passwords still start with it.

Why it mattered

It showed what happens when a company stores passwords exactly as people type them: one break-in exposes every password at once, including the ones people reused elsewhere. The company later settled charges from the US Federal Trade Commission, which required it to put a data security program in place.

The lesson today

You cannot control how a website stores your password. You can control whether that password works anywhere else. A unique password for every account means a breach at one site stays at one site, and multi-factor authentication stops a stolen password from being enough on its own.