Incident Overview

A threat actor operating under the handle "RatBridge" claims to be selling a credential compilation containing 5 billion unique email:password pairs. According to the post, the dataset is distributed as a 180GB file and has been cleaned to remove duplicates. The threat actor states that trash domains, short passwords, user:pass formats, and phone:pass formats have been removed from the collection.

The actor claims the dataset "would be good for any targets," suggesting it is intended for credential stuffing attacks. Pricing is listed at $2,000 for a single copy, with an option to purchase exclusive rights for $10,000 (negotiable). Contact is offered through Telegram, with a note stating "Real buyers only! No time wasters and sample collectors!"