123Fish

We noticed a significant influx of credential stuffing attempts targeting a broad spectrum of user accounts across various online services, prompting an investigation into potential data leaks. What struck us as particularly concerning was the recurring pattern of compromised credentials originating from a single, older e-commerce platform. This particular dataset, though not the largest we've encountered, exhibits a concerning combination of readily accessible user identifiers and their corresponding plaintext passwords, presenting a low-friction attack vector for malicious actors.

The breach, which occurred on 24-Oct-2018, involved the platform then known as 123Fish, a US-based e-commerce entity now operating as Aquarium Connection. A total of 12,414 records were compromised, with the leaked data comprising email addresses and plaintext passwords. This information was subsequently disseminated on a prominent hacking forum, likely serving as a valuable resource for threat actors engaged in credential stuffing and account takeover operations. The nature of the leak suggests a direct database compromise or the creation of a sophisticated combolist, enabling rapid exploitation against users who reuse credentials across multiple platforms.

While this specific breach from 2018 may not have garnered widespread mainstream media attention at the time, it represents a common threat vector that continues to plague users. The proliferation of such datasets on dark web forums is a well-documented phenomenon, often fueling subsequent waves of attacks. Security researchers have consistently highlighted the dangers of plaintext password storage, and this incident serves as a stark reminder of the long-term implications of such vulnerabilities. Organizations like the Identity Theft Resource Center have tracked similar breaches, underscoring the persistent risk posed by historical data exposures.

Our analysis revealed a concerning pattern of credential reuse, with a significant percentage of the leaked 123Fish email addresses and plaintext passwords appearing in other known data breaches. This suggests that a substantial portion of the compromised accounts were likely already vulnerable due to prior security incidents. The discovery was made through our continuous monitoring of dark web marketplaces and underground forums, where the dataset was identified and flagged for its potential to facilitate large-scale account compromises. The implications are clear: even older, seemingly minor breaches can have a cascading effect on user security across the internet.

The 123Fish dataset, dating back to October 24, 2018, exposed a total of 12,414 records, primarily consisting of email addresses and plaintext passwords. This information was found circulating on a popular hacking forum, indicating its availability to a wide range of threat actors. The breach appears to stem from a direct database compromise or the aggregation of data into a combolist, a common tactic for facilitating credential stuffing attacks. The fact that passwords were stored in plaintext is a critical vulnerability that significantly lowers the barrier to entry for attackers seeking to gain unauthorized access to user accounts.

While the 123Fish incident itself may not have been a headline-grabbing event, its impact is amplified by the ongoing trend of credential stuffing. Open-source intelligence (OSINT) and cybersecurity research consistently point to the reuse of credentials as a primary vector for account takeovers. This particular leak, by providing both email addresses and their corresponding plaintext passwords, directly feeds into this threat landscape. The implications for users who reuse credentials, and by extension for the services they use, are substantial and enduring.