Collection #1, 2019: 773 million addresses, and nobody was breached

In January 2019, a file called Collection #1 appeared on a popular cloud storage service and then on a hacking forum: 87 gigabytes, 12,000 files, 772,904,991 unique email addresses and 21,222,975 unique passwords. It was the largest set of credentials ever loaded into Have I Been Pwned. No company had been breached to produce it. That is what makes it worth a case file.

What it actually was

Collection #1 was a combination list: a merged, deduplicated set of email-and-password pairs assembled from thousands of separate, older breaches. Some of the source material was a decade old. Much of it had been cracked from hashes long after the original theft. The compiler's contribution was not intrusion; it was data cleaning.

And data cleaning is the valuable part. A hundred separate breach dumps, in a hundred formats, full of duplicates and dead addresses, is an awkward thing to attack with. One normalised file of unique pairs is a weapon you can point at a login page and leave running.

How the file gets used

Credential stuffing is the whole purpose. The mechanics are unglamorous:

1. Load the list into stuffing software, the well-known tools are sold openly and have graphical interfaces.
2. Point it at a target's login endpoint, often the mobile API rather than the web form, because mobile endpoints historically had weaker rate limiting.
3. Route the attempts through proxies so they appear to come from thousands of residential addresses rather than one server.
4. Harvest the hits. A success rate of a fraction of a percent, against tens of millions of pairs, still produces a very large number of working accounts.
5. Sell them by category. Streaming accounts, food delivery credit, loyalty points, gaming inventories, and, the valuable ones, email accounts, which can reset everything else.

Nothing here requires a vulnerability in the service being attacked. Every request is a correctly formatted login attempt with a correct password. That is precisely what makes it so hard to block, and why defenders moved from "keep attackers out" to "detect anomalous login patterns" over this period.

The Collections that followed

Collection #1 turned out to be one part of a set. Collections #2 through #5 followed within weeks, totalling roughly 845GB, an order of magnitude larger. Researchers at the Hasso Plattner Institute worked through the full set and found, unsurprisingly, enormous duplication.

This is the trap in reading any aggregate announcement. A claim of "26 billion records" or "10 billion passwords" is a file size statement, not an exposure statement. What matters is the number of unique, current, valid pairs, and that figure is always dramatically smaller, often by two orders of magnitude, than the headline. Since 2019, every few months has produced a new compilation announced in terms designed to be alarming. The honest response is to ask how many unique credentials are actually new.

Why the 2019 file still matters

Collection #1 is the moment credential stuffing became a mainstream concept rather than an industry term. It gave the public a concrete answer to a question people had been asking since 2012: why does an old breach at a site I do not use matter? Because the password does not stay at the site. It joins a list, the list gets cleaned, and the list gets tried everywhere.

It also made breached-password checking normal. Before 2019, blocking a password because it appeared in a public breach list was an unusual control. Afterwards it became a standard feature of identity platforms, browsers and password managers, and it is written into NIST's guidance: check the candidate password against a list of known-compromised values, and stop demanding arbitrary composition rules that push people towards predictable choices.

What to do about it

Finding your address in an aggregate is not an emergency, but it is a signal that your reuse habit has already been tested.