RockYou.txt

RockYou

RockYou was a social media company founded in San Francisco at the end of 2005 by Lance Tokuda and Jia Shen. It provided widgets and apps such as slideshows and games for MySpace and Facebook. The company filed for bankruptcy in February 2019.

The 2009 breach

In December 2009, a SQL injection vulnerability on RockYou's website was exploited and about 32 million user accounts were leaked. Shortly before the incident, the database security company Imperva had warned RockYou about the vulnerability, but it was not dealt with promptly.

What made the damage worse was that the company stored passwords in plain text, without hashing. There were other problems as well: passwords were sent by email unencrypted during account recovery, and symbols could not be used in passwords. In 2012, in a settlement with the US Federal Trade Commission (FTC), the company was required to put a data security program in place and to pay a civil penalty of 250,000 dollars for violations of the Children's Online Privacy Protection Act (COPPA).

rockyou.txt as a wordlist

The leaked passwords, with duplicates removed, circulated as rockyou.txt and came to be used in dictionary attacks. In Kali Linux it is included in the wordlists package, at /usr/share/wordlists/rockyou.txt.gz. Unpacked, it has 14,344,392 lines.

Later, huge password collections named "RockYou2021" and "RockYou2024" also circulated, but these are compilations of many past leaks and are said to have nothing but the name in common with the 2009 incident.