If You Reuse Passwords, the Akpr.ru Leak Should Worry You

HEROIC analysts identified the Akpr.ru breach while tracking older credential datasets being recirculated on dark web forums. The breach occured in August 2018, when the database of Akpr.ru, a Russian B2B agency based in Moscow, was compromised. A total of 108,624 records were exposed, including email addresses and MD5 password hashes. Despite the age of this breach, the data continues to surface in underground markets and remains a usable resource for attackers running credential stuffing campaigns.

How Business Email Addresses From Akpr.ru Fuel Targeted Attacks

Akpr.ru was a B2B agency, meaning many of the email addresses in this breach likely belong to business professionals. Attackers who obtain business email addresses can use them for spearphishing, where they craft highly convincing fake messages to trick recipients into handing over login credentials or sensitive company information. Combined with the MD5 password hashes, which are beleived to be easily crackable by modern tools, this dataset gives attackers both the email address and potentially the password needed to access corporate accounts.

What Was Exposed in the Akpr.ru Breach

• Email Address
• Password Hash (MD5)

Why a 2018 Russian IT Services Breach Still Matters Today

Credential data does not expire. The email addresses in the Akpr.ru breach can still be used to send phishing messages, and the MD5 hashes can still be cracked to recover plain-text passwords. Anyone who registered with Akpr.ru and reused that password on other services is accessable to account takeover, identity theft, and financial fraud today. In a business context, a single compromised employee credential can open the door to a much larger corporate network breach.

How a Database Breach Works

A database breach occurs when an attacker finds and exploits a vulnerability in a website or application to access the underlying data store. Common attack paths include unpatched software flaws, weak administrator passwords, and improperly secured database connections. Once inside, attackers copy user records in bulk and move them to private forums or encrypted channels where they are sold, traded, or used directly in automated login attacks. Victims are rarely notified promptly, if at all.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records including the Akpr.ru dataset. Whether you are an individual checking your personal email or a security professional monitoring your organization's exposure, HEROIC gives you fast, accurate results. Enter your email address now to find out if your data appeared in the Akpr.ru breach or any other incident in our database.