# MA-710.012019: MyCERT Alert - Best Practices on Safeguarding Email Credential

**Date:** 23 Jan 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-710.012019  
**Advisory ID:** MA-710.012019

---

**1.0    Introduction**
Recently, a cyber security researcher has discovered more than a billion of unique email address and password combinations had been dumped on cloud service MEGA and on a popular hacking forum. This data collection dubbed as "Collection #1" was a combination of a numerous different data breaches, which had been assembled to use for credential stuffing and a brute force attack to hijack accounts on other services.
**2.0    Impact**
An attacker can utilize a collection of unique email and password combinations for credential stuffing attacks and using bot to automatically test millions of email and password combinations on a whole range of website login pages.
**3.0    Recommendation**
MyCERT advises all users to be alert and do the necessary to secure their email credential. Attached below are some recommendations for users as preventive measures and mitigation steps against these email credential leak.
•    Use strong passwords. Select passwords that will be difficult for attackers to guess and use different passwords for different programs and devices. It is best to use long, strong passphrases or passwords that consist of at least 16 characters
•    Change default usernames and passwords. Default usernames and passwords are readily available to malicious actors. Change default passwords, as soon as possible, to a sufficiently strong and unique password.
•    Password manager. A secure vault to store a collection of password and other user credential such as credit card details and banking info in a safe and secure manner.
For incident reporting and other enquiries, please contact MyCERT through the following channels:
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#92f1ebf0f7e0abababd2f1ebf0f7e0e1f7f1e7e0fbe6ebbcffeb) or [[email protected]](/cdn-cgi/l/email-protection#35584c5650474175584c565047411b5a47521b584c)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**4.0    References**
•    <https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/>
•    <https://www.forbes.com/sites/kateoflahertyuk/2019/01/17/collection-1-breach-how-to-find-out-if-your-password-has-been-stolen/#7f8d63ef2a2e>