Breached in 2016, Still Circulating Today: The Ctinets Telecom Leak

HEROIC analysts first identified the Ctinets breach in 2016, but the data has recieved renewed circulation in recent months as it appears bundled inside larger aggregated dump files on dark web forums. The breach occured on August 1, 2016 and exposed 7,488 accounts on Ctinets, a Chinese telecommunications platform. The leaked database contained MD5-hashed passwords, one of the weakest hashing formats in use, meaning these passwords were already accessable to cracking tools the moment the data was stolen. Nearly a decade later, this same data keeps resurfacing, bought and sold by new threat actors who use it as raw material for credential stuffing campaigns.

How Telecom Account Credentials Are Used to Hijack Your Identity

Telecommunications accounts carry a unique risk: they are often linked to phone numbers, two-factor authentication flows, and account recovery options for other services. When your telecom credentials are exposed, attackers do not just gain access to one account. They may be able to leverage that access to reset passwords on your email, banking apps, or social media profiles. MD5-hashed passwords are partcularly easy to crack with widely available tools, which means the plain-text versions of Ctinets passwords have likely been in attacker hands for years.

What Was Exposed in the Ctinets Breach

• User Account Records (7,488 total)
• Passwords (MD5 hashed)
• Credentials from a Chinese telecommunications platform

Why a 2016 Telecom Breach Is Still Showing Up in 2024 Threat Feeds

The Ctinets breach is a clear example of how breach data never truly disappears. The data was seperate from mainstream attention when it first leaked, but it has been bundled into compilation databases and redistributed continuously since then. Attackers beleive that telecom credentials are worth holding onto because they can be combined with newer breach data to build comprehensive victim profiles. Credential stuffing, account takeover, identity theft, and SIM-swap fraud are all threats that become more viable when telecom account data is in the mix.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to the back-end data storage of a website or service. In the case of a telecommunications platform, this often means exploiting a vulnerability in the web portal or customer management system. Once inside, the attacker exports the user database, which contains account credentials in whatever format the platform used to store them. MD5 hashing, used by Ctinets, provides virtually no protection against modern cracking tools, so compromised passwords can be converted back to plain text in hours or days.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion exposed records, including telecommunications breaches like Ctinets that have been circulating across multiple dark web compilations. Enter your email now for a free check and see exactly which breaches your information has appeared in. The scan takes seconds and the results are immediate.