CHRM Global

We've seen a steady stream of older breaches resurface in recent months, often amplified by their inclusion in larger "combolists" circulating on hacking forums. What really struck us about the recent reappearance of the CHRM Global data wasn't the volume of records – around 14,000 – but the age of the breach, coupled with the continued use of plaintext passwords. The dataset had been circulating quietly, but we noticed increased chatter around it in a popular hacking forum, suggesting renewed interest in the exposed credentials. The fact that this data, from a breach dating back to August 2018, is still relevant enough to generate buzz highlights the persistent risk associated with credential reuse and the long tail of older breaches.

The HR Portal Breach: Plaintext Passwords from 2018 Resurface

CHRM Global, an India-based HR portal, suffered a data breach in August 2018 that exposed approximately 14,203 records. The breach was discovered after the dataset was posted on a well-known hacking forum, sparking renewed interest in the exposed credentials. What caught our attention was the combination of the breach's age and the fact that the database contained plaintext passwords. This significantly increases the risk of credential stuffing attacks, where attackers use the exposed usernames and passwords to try and gain access to other accounts. This incident underscores the importance of proper password hashing and salting, even for smaller organizations.

The breach matters to enterprises now because it highlights the ongoing threat posed by older breaches. Many users reuse passwords across multiple accounts, meaning that credentials exposed years ago can still be used to compromise accounts today. This is particularly concerning for HR-related platforms, as they often contain sensitive employee data. This incident ties into the broader threat theme of credential stuffing and the persistence of legacy vulnerabilities.

• Total records exposed: 14,203
• Types of data included: Email addresses, plaintext passwords
• Sensitive content types: None specified, but potential PII depending on user profile details within the platform.
• Source structure: Likely a database dump, given the nature of the exposed data.
• Leak location(s): Prominent hacking forum (specific URL unavailable, but described as a "prominent hacking forum").
• Date of first appearance: August 21, 2018 (initial breach), recent reappearance on hacking forums.

While we haven't found specific news coverage of the original CHRM Global breach from 2018, the incident aligns with a broader pattern of older breaches being re-released or traded on underground forums. For example, security researcher Troy Hunt's Have I Been Pwned database (haveibeenpwned.com) contains numerous older breaches, demonstrating the long-term availability of compromised data. Discussions on forums like Reddit's r/privacy often highlight the risks associated with password reuse and the importance of monitoring for exposed credentials.