AcidCave

We noticed a recent resurgence of interest in a data leak originating from AcidCave, a Polish community forum and fansite for the Might and Magic series. The initial exposure occurred on August 26, 2018, impacting approximately 5,242 unique user records. What struck us was the continued availability and potential re-use of this relatively old dataset, particularly given the nature of the exposed credentials. The dataset primarily consists of email addresses paired with MD5 hashed passwords, a combination that, while dated, can still be leveraged in credential stuffing attacks against other platforms.

The AcidCave breach, classified as a database compromise, resulted in the exfiltration of 5,242 records. The primary data types exposed were email addresses and MD5 hashed passwords. Analysis of the leaked data indicates a straightforward database dump, likely extracted via SQL injection or compromised administrative credentials. The threat theme here is clear: the reuse of credentials across different online services. Even though MD5 is a weak hashing algorithm, its presence in this dataset, coupled with email addresses, makes it a prime candidate for inclusion in combolists used by threat actors to test common password combinations or brute-force weaker accounts on other, more valuable targets. The leak was initially disseminated on a well-known hacking forum, ensuring broad accessibility to malicious actors.

While this particular AcidCave leak did not generate significant mainstream news coverage at the time of its discovery, it aligns with a broader trend of niche community sites being targeted. Such breaches, though seemingly minor in scale, contribute to the ever-growing pool of compromised credentials that fuel larger, more sophisticated attacks. The continued availability of these older datasets underscores the importance of proactive credential hygiene and the long-term risk associated with using weak hashing algorithms.