The cache includes 1.2 billion username and password combinations and more than 500 million email addresses. The discovery was made Tuesday by Milwaukee firm Hold Security and confirmed by a security expert at the request of the New York Times. The hackers targeted websites from the Fortune 500 to tiny ones, including some in Russia. The loot could be worth a lot given they contain information used for identity theft, although little of it has been sold thus far. Most of the accounts are being used to send spam on social networks, which the crime ring gets paid for by other groups. The Russian government isn’t believed to be behind the hackers but Moscow doesn’t exactly prosecute cyber criminals with much gusto.