A Russian gang has stolen more than 1.2 billion online usernames and passwords.

The breach was revealed by Hold Security, which says the hackers pushed spying programs to PCs worldwide. So when people logged on, the thieves got their passwords sent to them.

Experts say changing your password all of the time may not work anymore, since hackers use automated programs.

John Moynihan, president of Minuteman Governance, says people should change their passwords for online banking, brokerage and investment accounts immediately.

"There are 42,000 websites from which these accounts were taken, and they haven't announced which ones," he said.