Earlier this week, mass panic ensued when a security firm reported the recovery of a whopping 272 million account credentials belonging to users of Gmail, Microsoft, Yahoo, and a variety of overseas services. "Big data breaches found at major email services" warned Reuters, the news service that broke the news. Within hours, other news services were running stories based on the report with headlines like "Tech experts: Change your email password now."

Since then, both Google and a Russia-based e-mail service unveiled analyses that call into question the validity of the security firm's entire report.

"More than 98% of the Google account credentials in this research turned out to be bogus," a Google representative wrote in an e-mail. "As we always do in this type of situation, we increased the level of login protection for users that may have been affected." According to the report, the compromised credential list included logins to almost 23 million Gmail accounts.

Separately, Mail.ru, Russia's biggest e-mail provider, has said that more than 99.98 percent of the credentials it received from security firm Hold Security turned out to be invalid accounts. Almost 23 percent of Hold Security's entries contained addresses that don't exist, and 65 percent of the listed accounts contained passwords that were wrong. The 12 percent of remaining accounts had already been temporarily suspended by Mail.ru because officials considered them compromised or controlled by bots.

Yahoo Mail and Microsoft Hotmail—which according to Reuters are the providers for 40 million and 33 million of the compromised accounts, respectively—have yet to publicly comment. But their silence speaks for itself. Had these companies found even a tenth of those accounts had been hacked, they would have immediately issued mandatory password resets that would have been widely reported by now.

What has been clear all along to anyone paying attention is that the plaintext credentials recovered by Hold Security almost certainly didn't come from hacks on the e-mail providers. Instead, they most likely were collected by hackers who hit dozens, hundreds or thousands of third-party Web services over the years and dumped the account databases into a single list.

Since most of these services require users to supply an email address as a user name, it's not surprising that the compiled list would contain millions of addresses provided by some of the world's biggest providers. But even if the credentials were valid—a big if, given the results of Google's and Mail.ru's analysis—that doesn't mean the list automatically provided a way to gain access to an affected user's Gmail or Hotmail account. That would happen only if a user reused the password on both a third-party website and the Gmail or Hotmail account. Yes, that practice is all too common, but it's nowhere near universal. Based on the finding that almost 23 percent of the supposedly compromised Mail.ru addresses didn't exist, it may also be the case that the hacker who Hold Security said turned over the data padded an aging list of compromised credentials with credentials that never existed in the first place.

Enter the script kiddie

Hold Security said the hacker had offered to sell the list for less than $1, but ultimately surrendered it for free in exchange for some kind words on social media sites. This, too, should have been a red flag. It suggested the list wasn't the work of a sophisticated operation out to make money, but an amateur script kiddie whose massive data trove can be bought for a pittance.

In Hold Security's defense, the company's report said all along that the the list was a "collection of multiple breaches over time." In an e-mail Hold Security founder and Chief Information Security Officer Alex Holden also pointed out that more than 12 percent of the Mail.ru accounts have been confirmed to be compromised, an indication that there was some accuracy to the list.

"We have no reason to believe that Mail.ru was breached directly, but these credentials could have been stolen from other sites which may hold private data of the users," Holden wrote.

Still, there was no reason for reason for Hold Security to shop the list to reporters without first checking its validity with Mail.ru and the other affected providers. Compare that no-questions-asked approach with the strict verification practices Troy Hunt's breach notification service Have I been Pwned follows before reporting compromises.

And Hold Security's report should have explicitly stated what Holden made clear in his e-mail: that there was no reason to think any of the affected e-mail providers had themselves been hacked. Even after countless articles suggested or outright reported otherwise, Holden allowed the misinformation to go unchecked. It's not the first time the security researcher has been criticized for the way he handled disclosure of a major password dump.

With hacks of dating sites, personal computers, and government sites occurring on a daily basis, there's tremendous value in research that raises awareness about the importance of adopting safe online practices. But the risk of stories like this one is that they distract people from true threats. As the saying goes, garbage in, garbage out. When the original source is a script kiddie who sells data for a dollar and a thank you, researchers and journalists have a responsibility to double and triple check its accuracy before reporting it as fact.

Update:

After this story was published, Yahoo officials issued the following statement: