( CNN ) -- At least 1.2 billion usernames and passwords hacked . Is this truly scary or corporate fearmongering ? The New York Times published an article this week that has shocked the public . The article says that a Russian cybercrime group by the name of CyberVor has amassed this astoundingly large number of credentials from upwards of 420,000 distinct web sites . My immediate response was : Yeah , so ? In the context of the story it would seem that countless passwords are now known to this criminal group , and we should be panicking and changing all of our passwords . But wait a minute . Hold Security , the company that found this hack , may have a commercial interest in this reaction . Hold Security offers to tell companies if their usernames and passwords were compromised for the princely sum of $ 120 . Arguably , Hold Security stood to make more money out of this story than the Russian hackers themselves . Rather than go down the rabbit hole , let 's focus on what this really means and how we should react . While 1.2 billion is a big number , it appears that many of these credentials could have been obtained from previous large-scale breaches such as Adobe , Sony , LinkedIn , RockYou.com and eBay . The totals from these sites alone adds up to close to half a billion . We can also assume that many of the 420,000 hacked websites were Mom and Pop blogs , forums and other places where people often consider using a `` throwaway '' password . The concept is that things like your email , social media and bank require secure , unique passwords . But all the other junk in our lives can just use a simple , less secure password . The criminals do n't have the passwords in most cases . They have cryptographic representations of the passwords known as hashes . These hashes come in a lot of varieties with varying degrees of security associated with them . The purpose of a hash is to slow down an attacker from being able to acquire your password if a password database is stolen . This hashing is most effective if you follow good security practices , like not using dictionary words , and making sure to include numbers and symbols in your password . People in general are bad at choosing passwords . That means hashing is often only a speedbump for a determined attacker . But the hashes bring out the truth of the matter . The criminals do n't necessarily even have your password . They have a hash that could result in them discovering your password , especially if it is poorly chosen like password123 or qwrtyasdfg . Many of these stolen hashes may have been obtained some time ago , which means they are less useful to the crooks now . Of course , we do n't know the truth and ca n't analyze what is known because Hold Security is trying to figure out how to monetize the knowledge , leaving even the experts a bit in the dark about how serious a discovery this truly is . My advice ? Keep calm and carry on . It is always a good practice to use strong passwords and different passwords on the different sites we use and change them if we have reason to believe they might be compromised . There are many tools available to assist with automating this task , making it only a minor inconvenience to keep track of your new stronger passwords . Many are available at no cost . And if we have learned anything during our first 20 years of web surfing , it 's that we need a helping hand with our passwords . Hold Security 's findings are interesting . If the research community gains access to the information we will all jump in with both feet to determine how it happened , what it means for Internet security going forward and possibly even who is behind the attacks . But for the rest of the world ? It 's business as usual . Think before you click , do your best to follow best practices with regard to your privacy and safety and enjoy your online experience . It 's not as scary as it looks .
New York Times : 1.2 billion usernames and passwords were hacked by Russians . Chester Wisniewski : This is not as scary as it sounds , come on . He says company that did the hack may have a commercial interest in the reactions . Wisniewski : Of course , it 's always good practice to use strong passwords .