Chaotic Impulse

We've been tracking a resurgence of older breaches appearing in combined "combo lists" on Telegram channels frequented by credential stuffing actors. These older datasets, often overlooked due to their age, can still contain valid credentials for users who haven't updated their passwords across all services. What really caught our attention with the Chaotic Impulse breach was the relatively clean data and its reappearance now, nearly a decade after the initial incident, suggesting continued utility for attackers.

Chaotic Impulse Breach: 8,758 Accounts Resurface in Credential Stuffing Operations

The Chaotic Impulse breach, dating back to January 1, 2014, involved the exposure of 8,758 user accounts from the site. While the volume is small compared to mega-breaches, the data quality and recent rediscovery make it noteworthy. We observed the dataset advertised on a Telegram channel known for aggregating and selling combo lists used in credential stuffing attacks. The breach was discovered through routine monitoring of these channels.

This incident caught our attention because the data included not only email addresses and usernames, but also passwords. The passwords were in a hashed format, but given the age of the breach, it's likely many have already been cracked or are susceptible to rainbow table attacks. The reappearance of this data suggests that threat actors are actively seeking out and leveraging older breaches, betting on user password reuse across different platforms.

The Chaotic Impulse breach matters to enterprises because it highlights the ongoing risk posed by legacy credentials. Even seemingly outdated breaches can provide attackers with a foothold if users have reused those passwords on corporate accounts or services. This ties into the broader threat theme of password reuse and the effectiveness of credential stuffing attacks, especially when combined with stealer logs containing more recent credentials.

• Total records exposed: 8,758
• Types of data included: Email Address, Username, Passwords (Hashed), Hash Type
• Sensitive content types: Potentially PII depending on username content.
• Source structure: Database
• Leak location(s): Telegram channels
• Date of first appearance: 01-Jan-2014, resurfaced recently.

While specific details on the original breach circumstances are limited, its presence in credential stuffing combo lists is a clear indicator of its ongoing exploitation. Security researchers have consistently warned about the dangers of password reuse, and incidents like the Chaotic Impulse breach underscore the importance of implementing measures such as password managers, multi-factor authentication, and proactive password monitoring to mitigate the risk of credential compromise.