119,978 Cosensa Users Exposed in UK Training Platform Breach

In August 2018, Cosensa, a UK-based professional training and organizational development provider, suffered a data breach that exposed the account credentials of 119,978 users. The breach involved a database dump containing email addresses and plaintext passwords, which were subsequently compiled into combolists and circulated across underground forums and dark web markets. Cosensa specializes in leadership development, management training, and professional qualifications for businesses and public sector organizations across the UK -- a user base of professionals whose corporate email addresses and reused passwords represent attractive targets for business email compromise and corporate account takeover attacks.

Why This Is Dangerous

Plaintext password storage represents a complete failure of credential security. When a database containing plaintext passwords is exfiltrated, every single user's actual password is immediately available to the attacker -- no cracking, no computation, no delay. For Cosensa's 119,978 affected users, thier passwords were exposed without any protective barrier. Professional training platform users frequently use the same password across corporate systems, VPNs, Microsoft 365 accounts, and other business tools, making the cascading risk from a single plaintext breach extremely serious. Attackers who obtain corporate email addresses paired with actual passwords can attempt direct access to organization email systems, cloud platforms, and internal applications. Credential stuffing attacks using this data target UK corporate and government platforms where Cosensa clients work, potentially enabling unauthorized access to sensitive business systems and confidential information. The continued circulation of this dataset in underground markets means the threat has not diminished since 2018.

What Was Exposed

• Email addresses for 119,978 Cosensa registered users
• Plaintext passwords stored without any hashing or encryption
• Account data associated with Cosensa's UK professional training platform
• Credentials compiled into combolists circulated on dark web forums and Telegram channels

Why This Matters

Professional training platforms serving business and public sector clients represent a uniquely valuable target for attackers because their user databases consist largely of professionals with access to corporate systems. Nearly 120,000 plaintext passwords from a UK professional development provider gives attackers direct credentials to test against Microsoft 365, Google Workspace, corporate VPNs, and government portals. Many affected users almost certainly never recieved any breach notification from Cosensa. The scale of this breach -- nearly 120,000 records -- combined with plaintext password storage makes it particulary significant among UK professional services data exposures. Organizations whose employees trained through Cosensa face ongoing risk if those employees reused their Cosensa passwords in corporate environments.

How Database and Combolist Breaches Work

A database breach typically occured when an attacker identified and exploited a vulnerability in the target web application -- such as an SQL injection flaw, a misconfigured server, or compromised administrative credentials. Once inside, the attacker exported the user account table. When that table stores passwords in plaintext rather than using a hashing algorithm, the breach immediately delivers complete, ready-to-use credentials. The stolen data gets organized into combolists and distributed through underground markets, where automated credential stuffing tools test every email-password pair against target websites. Professional and corporate platforms are prioritized targets because successful logins can yield access to business systems with financial and data value. The Cosensa combolist has circulated in these markets since 2018 and continues to appear in active datasets.

Check If You Are Affected

If you ever registered an account on cosensa.co.uk to access professional training courses, management qualifications, or organizational development resources, your email address and actual password were exposed in this breach. Take these steps immediately:

• Search your email address in HEROIC's breach database to confirm whether your Cosensa credentials appear in known breach datasets
• Change the password you used for Cosensa on every platform where you used the same or similar password
• Prioritize your work email account, corporate VPN, Microsoft 365 or Google Workspace, and any government or public sector portals
• Notify your IT security team if you used your Cosensa password in corporate systems
• Enable multi-factor authentication on all work and personal accounts immediately
• Use a password manager to generate and store unique passwords for each account going forward

HEROIC's breach monitoring service provides real-time alerts when your credentials appear in newly discovered breach datasets and combolists. For professionals whose email addresses and plaintext passwords were exposed in the Cosensa breach, continuous monitoring and immediate password hygiene are essential steps to reduce ongoing risk to personal and organizational accounts.