Collection #1 was not the only large credential dump reported in early 2019. Dark Reading reported that six additional collections linked to the same forum post contained almost three times as many records as Collection #1 after duplicates were accounted for. Those are historical figures—not a measure of how many passwords still work today.
What was Collection #1?
In a February 12, 2019 report, Dark Reading’s Joe Stanganelli described a dark-web forum post linking seven databases of authentication data. One was Collection #1; the other six were Collection #2 through Collection #5, ANTIPUBLIC #1, and AP MYR & ZABUGOR #2. The data included email-and-password pairs, username-and-password pairs, and cellphone-number-and-password pairs. Dark Reading’s report attributed the discovery to Recorded Future researchers.
Dark Reading reported 772,904,991 unique email addresses and 21,222,975 unique passwords in Collection #1. These counts refer to distinct addresses and passwords, respectively; they should not be read as a count of accounts whose credentials were verified as current or usable.
How large were the six additional dumps?
The report described the six further dumps as containing almost three times the number of records in Collection #1 after duplicates were accounted for. It also said all seven collections together amounted to nearly one terabyte of authentication data. These are the article’s 2019 claims, not independently verified measurements of current exposure.
Recommended Free Tools
#1 Best Overall
| Collection | Reported size in Dark Reading (2019) |
|---|---|
| Collection #1 | Slightly more than 87 GB |
| Collection #2 | 528.5 GB |
| Collection #3 | Not stated in the report |
| Collection #4 | 178.58 GB |
| Collection #5 | Not stated in the report |
| ANTIPUBLIC #1 | Slightly over 102 GB |
| AP MYR & ZABUGOR #2 | Not stated in the report |
File size and record count are different measures. A larger file does not necessarily contain more distinct credentials: files can vary in formatting, and the report’s comparison of record totals specifically accounted for duplicates. Dark Reading also said the collections came from older breaches. The figures above describe what the 2019 article reported about the files, not a present-day count of exposed or active accounts.
Can old leaked passwords still be used?
Sometimes, if a person reused a password. A password changed on a major service may still be active on a smaller or rarely used site. A credential from an old breach may therefore help someone try to access a different account, even when it no longer works on the service where it was first exposed. The 2019 report warned about that reuse risk; it did not establish that every credential in these collections remained valid.
Old passwords can also make scams more persuasive. Dark Reading recounted a sextortion tactic in which a message cited the recipient’s old password to imply that the sender had access to their device or private material. Knowing an old password is not, by itself, proof that a sender has such access. It may be a detail taken from a prior breach and used to create urgency or fear.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can these collections reveal about passwords?
Large credential sets can help researchers and attackers look for patterns in password choices. But frequency does not always mean a string is a popular human-created password. The article used a VerticalScope example to caution that some unusually frequent strings could reflect bot accounts reusing credentials rather than people independently choosing the same password. That distinction matters when interpreting patterns drawn from breached data.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
