Bettesworths

We noticed an unusual spike in credential stuffing attempts originating from a known cybercrime forum, which led us to investigate a recently surfaced dataset. What struck us was the relatively low pwned count, yet the persistent nature of the attack vector suggested a deliberate and targeted effort. The dataset, attributed to Bettesworths, a UK-based real estate platform, contained approximately 5,621 records, primarily consisting of email addresses and their corresponding MD5 hashed passwords. The fact that this data is resurfacing nearly four years after the initial leak indicates a potential for ongoing exploitation, even with older, potentially less secure hashing algorithms.

The Bettesworths breach, discovered on August 26, 2018, involved a database compromise that exposed 5,621 unique records. The core of the exposed information comprised email addresses and MD5 hashed passwords. The source structure points towards a direct database exfiltration, rather than a more complex application-level vulnerability. This data was subsequently published on a prominent cybercrime forum, making it readily available to malicious actors. The use of MD5, a historically weak hashing algorithm, means that even without a direct database compromise, these password hashes are highly susceptible to brute-force attacks and rainbow table lookups, effectively rendering them as plain text for many attackers. This breach is significant because it highlights the long-term risk associated with legacy security practices and the persistent threat of credential reuse, even years after the initial compromise.

While this specific Bettesworths breach did not garner widespread mainstream news coverage at the time of its discovery, similar incidents involving UK-based real estate platforms have been documented. OSINT investigations into the cybercrime forum where the data was found reveal a consistent trade in compromised credentials, often used for further phishing campaigns or to gain access to other, more sensitive systems through credential stuffing. Research from organizations like Troy Hunt (creator of Have I Been Pwned) consistently demonstrates the enduring impact of older, weaker hashing algorithms like MD5, which continue to be a significant vulnerability in many leaked datasets.