Bonivital Bounce Cup

We noticed an unusual pattern of credential stuffing attempts targeting a subset of our user base, which prompted a deeper investigation. What struck us was the rapid escalation of these attempts, suggesting a readily available and potentially large dataset of compromised credentials. The timing of these activities correlated with a publicly reported breach from several years prior, indicating a persistent threat actor leveraging older, but still effective, vulnerabilities.

The Bonivital Bounce Cup breach, discovered on August 26, 2018, exposed approximately 6,000 records from their online platform. This incident, which involved a database compromise, resulted in the exfiltration of 3,839 unique email addresses, each paired with either a bcrypt or MD5 hashed password. The compromised data was subsequently disseminated on a prominent hacking forum, classifying it as a significant risk for credential reuse. The threat theme here is the enduring value of seemingly old breach data, particularly when combined with common hashing algorithms that can be susceptible to brute-force or dictionary attacks, especially for weaker passwords.

While specific news coverage directly linking this particular breach to widespread subsequent attacks is limited due to its age, the general phenomenon of older breach data resurfacing and being weaponized is well-documented. Security researchers have consistently highlighted the dangers of password reuse and the longevity of hashed credentials in the hands of malicious actors. For instance, reports from organizations like the Identity Theft Resource Center (ITRC) frequently detail the impact of credential stuffing attacks, often fueled by data from past breaches, underscoring the importance of proactive credential hygiene and robust authentication mechanisms.