Hackers steal usernames and passwords for TWO MILLION social media accounts - and many of the log-ins were as easy as '123'

• Hackers possibly compromised 326,000 Facebook accounts; 60,000 Google accounts; 59,000 Yahoo accounts and 22,000 Twitter accounts
• Stolen credentials were found on served used to control network of hacked computer called 'Pony botnet' 
• Victims were from the U.S., Germany, Singapore and Thailand
• Facebook and Twitter said the companies have reset the passwords of affected users
• Nearly 16,000 hacked accounts used password '123456'

By Daily Mail Reporter

Published: 21:28 EDT, 4 December 2013 | Updated: 08:55 EDT, 5 December 2013

Security experts have uncovered a cache of some 2 million pilfered passwords to popular social media websites including Facebook, Google, Twitter and Yahoo from Internet users across the globe.

Researchers with Trustwave's Chicago-based SpiderLabs said they discovered the credentials while investigating a server in the Netherlands that cyber criminals use to control a massive network of hacked computers known as the ‘Pony botnet.’

The company said Wednesday that it has reported its findings to the largest of more than 90,000 websites and Internet service providers whose customers' credentials it had found on the server.

'Dislike': Hackers stole usernames and passwords to more than 326,000 Facebook Inc accounts

The data includes more than 326,000 Facebook Inc accounts; some 60,000 Google Inc accounts; more than 59,000 Yahoo Inc accounts and nearly 22,000 Twitter Inc accounts, according to SpiderLabs.

Victims were from the U.S., Germany, Singapore and Thailand, among other countries, with the Netherlands at the top of the list.

Representatives for Facebook and Twitter said the companies have reset the passwords of affected users, but there were no word from Goggle or Yahoo.

'Facebook takes people’s information security extremely seriously and we work hard to protect it,' a statement from the company read. 'While details of this case are not yet clear, it appears that people’s computers may have been attacked by hackers using malware to scrape information directly from their Web browsers.'

SpiderLabs said it has contacted authorities in the Netherlands and asked them to take down the rogue Pony botnet server.

An analysis posted on the SpiderLabs blog showed that the most-common password in the set was ‘123456,’ which was used in nearly 16,000 accounts.

Other commonly used credentials included ‘password,’ ‘admin,’ ‘123’ and ‘1.’

Under attack: Log-in information has been stolen for 60,000 Google accounts and more than 59,000 Yahoo accounts

Nearly 22,000 Twitter accounts were caught up in the hacking, which has been going on since late October

Graham Cluley, an independent security expert, said it is extremely common for people to use such simple passwords and also re-use them on multiple accounts, even though they are extremely easy to crack.

‘People are using very dumb passwords. They are totally useless,’ he said.

Researchers at the security company Trustwave analyzed the passwords compromised and found that only 5 per cent were excellent and 17 per cent were good. The rest were moderate or worse

CNN Money reported that the virus was installed in late October on an untold number of computers around the globe to net in credentials and then send them to a server controlled by the hackers.

Late last month, cyber security experts found the server in the Netherlands jam-packed with usernames and passwords for more than 93,000 sites.

Trove: Cyber security experts found a rogue server in the Netherlands filled with usernames and passwords for more than 93,000 sites

Besides Twitter and Facebook, the hackers potentially compromised accounts on the Russian social media forum Odnoklassniki, LinkedIn and also ADP, which is used by numerous companies to manage payroll.

‘We don't have evidence they logged into these accounts, but they probably did,’ said John Miller, a security research manager at Trustwave.