This may be of interest to some folks here, and I’ve not yet seen anything on it.

On 27 March prosecutors in Verden in northern Germany seized a list of about 18 million stolen e-mail addresses and passwords.  Every German e-mail provider as well as several international ones are affected.  About three million of the accounts have the German .de domain suffix, but that leaves open the possibility that quite a few non-Germans have been victimized as well.

The story broke day before yesterday (Thursday) in Der Spiegel: Cyberkriminalität: Fahnder entdecken 18 Millionen gestohlene E-Mail-Passwörter.  This follows a theft of about 16 million e-mail addresses and passwords in January.  However, the new theft is more serious: most of the January data were obsolete, but most of these accounts and passwords are believed to be active.  Reportedly the hacked e-mail accounts have already been used to spread spam, and some of them are e-mail and password combinations for online shopping portals.  German e-mail providers are to notify directly any of their customers who are victims, and by Monday there may be a German website where others can determine whether they are among the victims.

Der Spiegel suggests that the same group of hackers is responsible for both thefts and that they may be based in one of the Baltic countries.  More links in English and German below the free-floating orange paraph.

An English account from Deutsche Welle: German officials confirm 18 million emails and passwords stolen.

An English account from SBS (Australia): Germany alerts owners of stolen passwords.

A German account from tagesschau.de.

Tue Apr 08, 2014 at 12:28 AM PT: Anyone whose e-mail provider is one of Deutsche Telekom, Freenet, GMX, Kabel Deutschland, Vodafone, and Web.de is supposed to have been notified by the provider if his or her address is one of the stolen ones.  For everyone else the BSI (Bundesamt für Sicherheit in der Informationstechnik; Federal Office for Information Security) has set of a German-language web page here.  Go to the bottom of the page.  Check the box by Ich bin damit einverstanden, ...; you’re agreeing that any personal data that may arise in the process may be used for the check and may used to detect (internet) abuse, and you’re affirming that any e-mail address that you check is yours.  Then enter your e-mail address in the obvious box and click on the Überprüfung starten button.  You will get a four-character code.  If your address is in the stolen collection, you will be notified by e-mail, and the code will be in the subject.  If you get an e-mail purporting to be from this test, and its subject contains no code or the wrong code, delete it unopened.  If you get no response, the address that you submitted is not in the database.

Your Email has been sent.