Baseball Prospect (2020)

We noticed a significant data leak surfacing on a well-known hacking forum on April 24, 2020. This incident involved Baseball Prospect, a U.S.-based sports news website that has since ceased operations. What struck us was the dual nature of the password storage, with both bcrypt hashes and, more concerningly, plaintext passwords exposed. This dual exposure significantly amplifies the risk to affected users, moving beyond simple credential stuffing to potential direct compromise of accounts if other services share the same credentials.

The breach, affecting 55,837 users, appears to stem from a direct database compromise. The exposed data set contained a mix of email addresses and password hashes, with the critical inclusion of plaintext passwords. This hybrid approach to password security suggests a potential legacy system or a phased migration, leaving a substantial portion of the user base vulnerable to immediate exploitation. The presence of both hash types, bcrypt and plaintext, indicates varying levels of security implementation across the user base or potentially different data sources within the compromised infrastructure. The leak was categorized as a database breach, with evidence suggesting it was also leveraged as a combolist due to the inclusion of readily usable credentials.

At the time of discovery, there was no significant external reporting or widespread OSINT surrounding this specific breach. However, the nature of the exposed data, particularly the plaintext passwords, aligns with common tactics observed in credential stuffing attacks. Research into similar breaches from that period consistently highlights the continued prevalence of poorly secured password storage practices, even in seemingly niche online platforms. The defunct status of Baseball Prospect further complicates remediation efforts for affected individuals, as direct contact or account recovery options are likely unavailable.