Tumbler announced that it had recently been breached and email addresses and passwords had been downloaded.

Tumbler did not say how many accounts had been affected. But, according to security expert Troy Hunt, who runs the site Have I Been Pwned, the total equals around 65,469,298 account credentials leaked.

Tumbler is of course asking its users to change their passwords. But users need to be aware that their email addresses and salted passwords are being sold on the dark web for 0.4255 Bitcoin ($225) on the darknet marketplace The Real Deal.

With that information being leaked, criminals can use the email addresses to send spear phishing emails pretending to be from Tumbler and possibly steal further personal info of the victims or deliver malware.

The same hacker is selling the compromised login account data from Fling, LinkedIn, and MySpace.

Source: WeLiveSecurity