A mysterious Russian crime gang has reportedly amassed the largest ever cache of stolen website passwords – over a billion – which experts say were swiped from poorly secured user databases.

A network of computers quietly hijacked by malware, and controlled from afar by the crooks, identified more than 420,000 websites vulnerable to SQL injection attacks, we’re told. These sites were flagged up to the malware’s masters, who then returned to harvest 1.2 billion unique records by exploiting those website vulnerabilities.

Hackers did not just target U.S. companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites,” said Hold Security chief information security officer, Alex Holden. “And most of these sites are still vulnerable.”

So far, little of the information stolen in the wave of attacks appears to have been sold to other online crooks, according to the Times. Instead, the information is being used to send marketing pitches, schemes and other junk messages on social networks on Twitter, the newspaper said.

The breadth of these break-ins should serve as a chilling reminder of the skullduggery that has been going undetected on the internet for years, said John Prisco, CEO of another security firm, Triumfant.

“This issue reminds me of an iceberg, where 90 per cent of it is actually underwater,” Prisco said in an emailed statement. “That’s what is going on here… So many cyber breaches today are not actually reported, often times because companies are losing information and they are not even aware of it.”