AgingPro

We noticed a significant influx of credential stuffing attempts targeting various enterprise applications in late Q3 2023. The patterns observed suggested a large, previously unassociated dataset was being systematically weaponized. What struck us was the age of the credentials, indicating a long-dormant but still potent source of compromised information. This particular dataset, originating from the now-defunct AgingPro platform, resurfaced on a prominent cybercrime forum, presenting a renewed threat vector for organizations that may still utilize or have users who previously registered on the platform.

The AgingPro breach, dating back to July 4, 2018, exposed 5,631 unique records. The compromised data primarily consisted of email addresses and SHA256 hashed passwords. This information was subsequently disseminated on a well-known cybercrime forum, likely contributing to its inclusion in various credential stuffing lists. The nature of the breach points to a database compromise, with the resulting data being repurposed into a combolist, a common tactic for malicious actors seeking to exploit password reuse across different services. The fact that this data is still being actively used over five years later underscores the persistent challenge of legacy credential exposure.

While AgingPro itself is no longer operational, the implications of this breach continue to resonate. News coverage from 2018 was minimal, reflecting the platform's niche focus. However, the subsequent appearance of this data on cybercrime forums has been consistently tracked by threat intelligence researchers monitoring credential dumps. The use of SHA256 hashing, while stronger than MD5, is still susceptible to brute-force attacks given sufficient computational resources and the availability of rainbow tables or custom dictionaries, especially when paired with common password patterns often associated with older accounts.

A recent surge in credential stuffing attacks across multiple client environments compelled our attention in early Q4 2023. The sheer volume and the specific patterns of failed login attempts suggested the activation of a substantial, previously uncatalogued credential set. What particularly stood out was the temporal disconnect; the attack vectors seemed to be leveraging credentials that were demonstrably old, yet surprisingly effective. This led us to investigate a dataset originating from "The Elder Care Network," a United States-based platform that ceased operations several years ago. The reappearance of this data, now circulating on a popular dark web marketplace, represents a latent but potent threat to any organization with users who may have registered on the platform during its operational period.

The Elder Care Network data breach, reported as occurring on July 4, 2018, involved approximately 5,631 user records. The exposed information comprises email addresses and SHA256 hashed passwords. This dataset was subsequently found to be available for purchase on a prominent cybercrime forum, indicating its active commodification. The breach appears to have originated from a direct database compromise, with the extracted information subsequently being formatted into a combolist. The continued exploitation of this data, nearly six years post-discovery, highlights the enduring risk posed by legacy data breaches and the challenges of effective user credential management in the face of persistent threat actor activity.

While the original incident involving "The Elder Care Network" received limited public attention in 2018 due to its specialized user base, the subsequent listing of its compromised data on dark web marketplaces has been a recurring point of interest for cybersecurity intelligence firms. The use of SHA256 for password hashing, while a standard at the time, does not render the credentials immune to modern cracking techniques, particularly when combined with the common practice of password reuse. OSINT analysis indicates that similar aged datasets are frequently refreshed and re-marketed by threat actors, making proactive identification and mitigation crucial.

Our threat intelligence platform flagged a notable increase in account takeover attempts leveraging a specific set of credentials in mid-November 2023. The commonality across these attempts, beyond the compromised credentials themselves, was the apparent age of the source data, suggesting a long-dormant but now reactivated threat. What was particularly concerning was the lack of direct association with any recent, high-profile breaches, indicating a more obscure but still impactful data leak. This led us to identify a dataset from "SeniorConnect," a defunct US-based online community for seniors, which had been compromised and subsequently listed on a well-known cybercrime forum.

The SeniorConnect data breach, dating back to July 4, 2018, compromised an estimated 5,631 records. The leaked information includes both email addresses and SHA256 hashed passwords. The data was discovered circulating on a prominent cybercrime forum, indicating its availability to threat actors for malicious purposes. The nature of the compromise points to a database breach, with the resulting data being weaponized into a combolist. The persistence of this dataset in the threat landscape for over five years underscores the long-term implications of even seemingly niche data breaches and the importance of continuous monitoring for previously compromised information.

Public reporting on the SeniorConnect breach in 2018 was scarce, reflecting its limited public profile. However, its subsequent appearance on cybercrime forums has been documented by various threat intelligence providers. The use of SHA256 hashing for passwords, while a security measure, is not impervious to modern brute-forcing techniques, especially when combined with common password patterns or dictionary attacks. The re-emergence of such older datasets highlights the ongoing challenge of credential stuffing attacks and the need for organizations to implement robust security measures, including multi-factor authentication and regular password rotation, to mitigate the risks associated with legacy data exposure.