NEW YORK (CNNMoney) -- Russian criminals have stolen 1.2 billion Internet user names and passwords, amassing what could be the largest collection of stolen digital credentials in history, a respected security firm said Tuesday.
The news was first reported by The New York Times, which cited research from Milwaukee-based Hold Security. The firm didn't reveal the identities of the targeted websites, citing nondisclosure agreements and a desire to prevent existing vulnerabilities from being more widely exploited.
Hold Security founder Alex Holden told CNNMoney that the trove includes credentials gathered from over 420,000 websites -- both smaller sites as well as "household names." The criminals didn't breach any major email providers, he said.
"In the course of this investigation that took seven months, we were able to research this particular gang and find this staggering discovery," Holden said.
Holden said the gang makes its money by sending out spam for bogus products like weight-loss pills, and had apparently amassed its collection of digital credentials for that relatively innocuous purpose.
"It's really not that impactful to the individuals, and that's why they were under the radar for so long," Holden said. "They've ignored financial information almost completely."
But Holden said the gang's success at amassing passwords demonstrates that weak security procedures are common on websites of all sizes.
The criminals began collecting user data a few years ago by simply buying it on the black market. Their stash has grown significantly this year thanks to their use of an automated program that trawls the Internet to find vulnerabilities on websites, Holden said.
The reported theft dwarfs the one revealed last year by discount retailer Target, which admitted in December that hackers had stolen credit- and debit-card data from 40 million accounts.
Hackers from Russia and Eastern Europe are known for launching sophisticated cyberattacks for financial gain. Beyond spam, organized crime syndicates in the region have engaged in more sophisticated activities like corporate espionage and the theft of credit-card details.
"They feel crimes will go unpunished because there is no extradition between Russia and the United States that I'm aware of. These people, as long as they don't attack their own, will be able to get away with stealing anything they want from America, Europe or other countries," Holden said.
Holden says if they sell the information, more accounts could be violated.
"If it gets into other hands on this black market, these people can use the credentials to get into any account that had been compromised. And because people reuse their passwords, in many cases these credentials may lead to other information including very private personal data," Holden said.
So far, it appears little of the stolen information has been sold to other crooks. Instead, the criminals are using the information to send marketing pitches and other junk messages on social media -- while collecting a fee for their services.
The extent of the theft shows people need to better manage their credentials, cybersecurity experts say. Most people keep the same password for multiple services, such as banking, email and social media accounts. That allows hackers to turn a single password database into a treasure trove.
One simple way to stem the damage is to use two-factor authentication whenever possible to sign into online services, said Eric Cowperthwaite, an executive at network security provider Core Security. This method requires you to enter a second password, usually generated by your smartphone, upon login.
Jay Kaplan, CEO of cybersecurity firm Synack, criticized the companies involved for not being alert enough about their own security.
"It's likely that most of them do not even realize how many times they've been compromised," he said.
You might be affected by this hack if you notice a lot of spam being sent to your email or social media accounts.