The thievery was described in a New York Times story based on the findings of Hold Security, a Milwaukee firm that has a history of uncovering online security breaches.
“As long as your data is somewhere on the World Wide Web, you may be affected by this breach,” Hold said in a statement on its website.
The identities of the websites that were hacked were not identified by the newspaper, which cited nondisclosure agreements that required Hold Security to keep some information confidential.
The reported break-ins are the latest to raise doubts about the security measures that companies use to protect information online. Security experts believe hackers will continue breaking into computer networks unless companies become more vigilant.
“Companies that rely on usernames and passwords have to develop a sense of urgency about changing this,” said Avivah Litan, a security analyst at the research firm Gartner.
Retailer Target is still struggling to win back its shoppers’ trust after hackers — believed to be attacking from Eastern Europe — stole 40m credit card numbers and 70m addresses, phone numbers, and other personal information last winter.
Alex Holden, the founder and chief information security officer of Hold Security, told the Times that most of the sites hit by the Russian hackers are still vulnerable to further break-ins.
Besides getting 1.2bn online passwords, the hackers also have amassed 500m email addresses that could help them engineer other crimes, according to Hold Security.
So far little of the information stolen in the wave of attacks appears to have been sold to other online thieves, according to the Times. Instead, the information is being used to send marketing pitches, schemes and other junk messages on social networks, it said.
The breadth of these break-ins should serve as a chilling reminder of the skullduggery that has been going undetected on the internet for years, said John Prisco, CEO of security firm, Triumfant.
“This issue reminds me of an iceberg, where 90% of it is actually under-water,” Prisco said.
“That’s what is going on here... So many cyber breaches today are not actually reported, often times because companies are losing information and they are not even aware of it.”