The Crimea Press Dump: 59 Stolen Login Records Hit the Dark Web

HEROIC analysts recorded the Crimea Press breach in data circulating as of September 27, 2023. Crimea Press is a Ukrainian news outlet covering politics and current affairs related to the Crimea region, operating in Russian. The breach exposed the account data of 59 registered users, including email addresses, phone numbers, full names, usernames, homepage URLs, and password hashes. While the number of records is small, the data types exposed represent a rich combination that can be used for targeted attacks against individuals who may include journalists, sources, or activists connected to a politically sensitive publication.

Why a Breach at a News Outlet Is Partcularly Risky for Those Involved

A data breach at any organization is concerning, but a breach at a news platform covering a conflict-adjacent region carries additional weight. The people who registered on Crimea Press may include journalists, contributors, researchers, or readers with strong political opinions. Having their real names, phone numbers, and email addresses in a leaked dataset means they could be identified, tracked, or targeted. Password hashes in this breach were stored using pHpass, an older hashing format that is more vulnerable to cracking than modern alternatives. Once cracked, those passwords can be tested across email providers, social platforms, and communication tools that the same individuals likely use in their professional and personal lives.

What Was Exposed in the Crimea Press Breach

• Email Address
• Phone Number
• First Name
• Last Name
• HomePage URL
• Username
• Password Hash

Why This Data Creates Long-Term Risk for Account Security

Even a small breach like this one feeds into the broader ecosystem of stolen data. The email addresses and usernames exposed here can be cross-referenced with other breaches to build more complete profiles of individuals. Homepage URLs can reveal professional identities, blog addresses, or affiliated organizations. Phone numbers enable direct contact attempts, SIM swapping, or SMS phishing. The password hashes, even in their encoded form, can be cracked offline using widely accessable tools, particularly when the underlying passwords are short or common. Once cracked, those credentials are added to databases used in credential stuffing attacks across thousands of websites simultaneously.

How a Database Breach Works

A database breach occured when an attacker finds a way into the systems where a website stores its user records. For news and media organizations, this often happens through outdated content management systems, unpatched plugins, or poorly secured administrator accounts. Once inside, attackers can copy the user database directly, extracting every account with its stored data. The pHpass password hashing format used here was common in older WordPress installations and similar platforms, and it is known to be weaker than modern alternatives like bcrypt or Argon2. Media organizations with limited IT budgets are frequently targeted precisely because their security infrastructure may not have kept pace with modern threats.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against a database of more than 400 billion compromised records, including the Crimea Press breach and thousands of others. Even if you only signed up for a small news site years ago, that data could still be circulating today. The scan is free, takes seconds, and requires no account. Visit HEROIC's breach scanner to find out if your information has been compromised.