Chinese Academy of Surveying & Mapping Data Breach

We noticed a data leak originating from the English-language portal of the Chinese Academy of Surveying and Mapping, dating back to August 21, 2018. The incident, which has since been largely unaddressed publicly, exposed over 10,000 user records. What struck us was the relatively low-tech nature of the compromise, involving a common database vulnerability and the subsequent distribution of credentials on a well-known dark web forum. The presence of MD5 hashed passwords, a notoriously weak hashing algorithm, is a significant concern given the ease with which these can be cracked.

The breach, affecting approximately 10,101 records, was a direct consequence of a database compromise on the now-defunct English portal. The exposed data primarily consists of email addresses and their corresponding MD5 hashed passwords. The source structure of the leak suggests a direct extraction from a user authentication database. This type of credential stuffing vulnerability, especially with weak hashing, is a prime vector for further downstream attacks. The data was subsequently found on a prominent hacking forum, indicating its availability to malicious actors for potential exploitation.

While this specific breach predates widespread public reporting, the methodology aligns with a common pattern of data exfiltration and sale on underground forums. The use of MD5 hashing, while outdated, was prevalent in 2018 and continues to be a point of exploitation for older systems. Research from security firms at the time consistently highlighted the risks associated with weak password hashing algorithms, emphasizing the need for stronger cryptographic methods like bcrypt or Argon2. The lack of subsequent public disclosure from the Academy suggests a potential lack of robust incident response protocols or a desire to minimize reputational damage.