Two Million Passwords Stolen From Facebook, Twitter, ADP

A security firm discovered a cache of roughly two million compromised credentials on a Pony botnet command-and-control server, dominated by Facebook, Yahoo, Google and Twitter accounts and including tens of thousands of FTP, RDP and SSH credentials (and some tied to ADP). The report highlights Pony's continued operation, a previous cache of ~650k credentials, and that most stolen passwords were weak, underscoring large-scale credential theft and the ongoing risk of account takeover and misuse.