The security of around 16 million different email accounts in Germany may have been compromised, and their usernames and passwords stolen, said the Federal Office for Information Security (BSI).
The security breach was discovered after the agency ran an analysis of networks of computers that have had a history of experiencing malware. A German-language website was set up in which those concerned about the security of their account were invited to submit their email address, and they will be given a four-digit PIN. If this PIN matches a previous PIN, it's an indication that the email address associated with the PIN may have been hacked.
Due to the overwhelming volume of the people who decided to access that website almost immediately after its launch, the website promptly crashed. However, the agency was able to collect over 16 million email addresses whose security may have been compromised. According to agency spokesman Tim Griese, about half the accounts have .de domain-name endings, indicating that most of the users are located within Germany. The compromised accounts have email addresses as their username.
However, the agency cannot simple send an email to these addresses. Because German law prohibits the agency from sending unsolicited emails, even if they contained relevant and urgent information about Internet security.
Those whose accounts were confirmed to be affected as well as those who suspected their accounts to be affected were advised to run an anti-virus software on all of their devices and change their passwords into more secure ones.
This was part of a much wider ongoing investigation, but the agency declined to issue any comment or statement regarding this. Griese himself refused to discuss any more details about the phenomenon, since the investigation was still ongoing.
Other Internet users are skeptical about this kind of analysis, claiming that it was all just a ruse to collect legitimate email addresses that the government can then appropriate for its own purposes.
However, the agency assured the public that this was not the case. "There will be no storing of email addresses after they have been tested," said Tim Griese, the agency's spokesman.
