CARIM-South

We noticed a recent resurgence of interest surrounding a dataset originally leaked in July 2018, now circulating on a prominent hacking forum. This particular breach involved CARIM-South, an organization focused on migration within the Southern and South-Eastern Neighborhoods of the European Union. What struck us was the continued relevance of this older leak, suggesting it's being leveraged in current credential stuffing campaigns. The dataset, affecting 2,744 users, contains a combination of email addresses and phpass password hashes, a common hashing algorithm that, while not plaintext, is susceptible to offline cracking with sufficient computational power.

The CARIM-South breach, discovered on July 6, 2018, originated from a database compromise. The leaked information includes 2,744 distinct user records, each containing an email address and a corresponding password hash. The hashing algorithm identified is phpass, a variant of MD5, which is considered weak by modern standards and vulnerable to rainbow table attacks and brute-force cracking. The significance of this leak lies in its potential for credential stuffing attacks against CARIM-South's services and any other platforms where these users may have reused their credentials. The source structure appears to be a direct database export, indicating a potentially broad compromise rather than targeted exfiltration.

While this specific breach did not generate widespread news coverage at the time of its initial leak, its re-emergence on hacking forums aligns with broader trends of older, seemingly forgotten datasets being repurposed for malicious activities. Researchers have consistently warned about the lifecycle of breached data, with older dumps often forming the backbone of large-scale credential stuffing operations. The prevalence of phpass hashes in this dataset is a reminder of the importance of migrating to more robust hashing algorithms and implementing multi-factor authentication to mitigate the impact of such compromises.

We observed a recent spike in activity related to a dataset originating from a breach of the University of Texas at San Antonio (UTSA) in late 2021. This incident, initially reported as affecting a significant number of individuals, has resurfaced on dark web marketplaces, indicating its continued exploitation. What's particularly concerning is the inclusion of sensitive personal information beyond basic contact details, suggesting a more intrusive level of compromise than initially understood. The dataset's re-emergence points towards sophisticated actors actively seeking and monetizing older, high-value data exposures.

The UTSA breach, discovered in November 2021, stemmed from a ransomware attack that resulted in the exfiltration of a substantial volume of data. The leaked information, impacting an estimated 2,700 individuals, includes full names, email addresses, dates of birth, and Social Security Numbers (SSNs). The threat theme here is identity theft and financial fraud, given the presence of SSNs. The source structure appears to be a direct dump of compromised database records, likely facilitated by the ransomware actors gaining administrative access. The leak locations have been observed on multiple dark web forums and marketplaces, underscoring the widespread availability of this sensitive information.

This UTSA breach garnered significant media attention upon its discovery in late 2021, with numerous news outlets reporting on the scale of the compromise and the types of data exposed. OSINT investigations at the time confirmed the validity of sample data circulating online. Research from cybersecurity firms has consistently highlighted the long-term value of SSNs in the hands of cybercriminals, enabling them to open fraudulent accounts, file fake tax returns, and engage in other forms of identity-related crime. The continued availability of this data underscores the persistent threat of identity compromise long after an initial breach is reported.

We've identified a new threat actor actively distributing a dataset linked to a 2019 incident involving a popular online gaming platform, "GameVerse." This leak, initially addressed by the company with limited public disclosure, has now been weaponized by a group known for its affiliation with credential stuffing operations. What's noteworthy is the specific focus on user account credentials, including both plaintext passwords and associated account identifiers, suggesting a direct intent to compromise active gaming accounts for in-game item theft or resale. The re-emergence of this data, nearly four years post-breach, highlights the enduring risk of compromised credentials.

The GameVerse breach, first documented in August 2019, resulted in the compromise of approximately 2,700 user accounts. The leaked data consists of usernames (or account identifiers) and plaintext passwords. The direct exposure of plaintext passwords is a critical vulnerability, bypassing any hashing or salting mechanisms that may have been in place. The threat theme is clear: direct account takeover and potential financial loss through the exploitation of in-game assets or direct account access. The source structure appears to be a curated list of compromised credentials, likely extracted from database logs or direct system access, and is being disseminated through private channels frequented by cybercriminals.

While the initial GameVerse breach received some coverage within the gaming community, it did not reach mainstream news outlets. However, the current distribution of this dataset aligns with ongoing research into the tactics of credential stuffing syndicates. These groups actively aggregate and refine leaked credential dumps to maximize their success rates against various online services. The presence of plaintext passwords in this dataset makes it particularly valuable for such operations, as it requires minimal effort to test against other platforms where users might have reused their GameVerse credentials.