deviz.ro

We noticed a significant data leak originating from deviz.ro, an online portal associated with construction estimating software. The discovery, made on August 1st, 2018, revealed a substantial exposure of user credentials. What struck us was the relatively straightforward nature of the compromised data, primarily consisting of email addresses and hashed passwords, yet the potential for downstream impact on a professional user base is considerable. The leak was disseminated through a well-known hacking forum, indicating a deliberate act of exfiltration and distribution.

The breach impacting deviz.ro, a platform for InterSOFT Devize's construction estimating software, involved a total of 28,686 records. The compromised data types are limited to Email Address and Password Hash. The hashes appear to be generated using bcrypt, a strong hashing algorithm, which mitigates immediate plaintext password exposure. However, the sheer volume of exposed credentials, coupled with the professional nature of the user base (likely individuals involved in construction and engineering), presents a risk of credential stuffing attacks against other services. The source structure of the leak suggests a direct database dump, and the leak location was identified as a prominent hacking forum, facilitating broad accessibility to the compromised information.

While this specific incident did not generate widespread mainstream news coverage at the time of its discovery in August 2018, similar breaches of professional service platforms are a recurring theme in cybersecurity. OSINT investigations into the deviz.ro domain reveal it as a legitimate portal for the software, underscoring the direct impact on the company's clientele. The use of bcrypt hashing, while a positive security measure, does not render the data entirely useless to determined attackers, especially when combined with other leaked information from different sources. This incident aligns with broader trends of attackers targeting business-oriented software platforms to gain access to professional networks and sensitive project data.

Our attention was drawn to a recent disclosure concerning a breach affecting the website of a Romanian online retailer, bargain.ro. The initial detection of this incident occurred on July 29th, 2021, revealing a substantial dataset readily available on a dark web marketplace. What was particularly concerning was the inclusion of personally identifiable information beyond basic contact details, alongside payment card fragments. The rapid dissemination of this information through illicit channels points to a sophisticated threat actor actively monetizing stolen data.

The bargain.ro breach, identified on July 29th, 2021, exposed approximately 12,000 records. The compromised data encompasses a wider array of sensitive information than typically seen in simpler credential dumps, including Email Address, Full Name, Phone Number, Physical Address, and crucially, partial Payment Card Data (specifically, the last four digits of the card number and expiration dates). The source structure suggests a compromise of a customer database, likely through SQL injection or similar web application vulnerabilities. The leak location was a known dark web marketplace, indicating a commercial motive for the exfiltration and sale of this highly sensitive consumer data.

This incident at bargain.ro gained some traction in cybersecurity news outlets, with several blogs and forums reporting on the availability of the data. OSINT analysis confirms bargain.ro as an active e-commerce platform. The inclusion of partial payment card details, while not full card numbers, significantly elevates the risk of fraud and identity theft for affected customers. This breach is emblematic of a persistent threat to online retailers, where attackers exploit vulnerabilities to access customer PII and financial information for illicit gain. Research into similar retail breaches highlights the ongoing sophistication of threat actors in identifying and exploiting weaknesses in e-commerce infrastructure.

We observed a concerning incident involving the compromise of a popular Romanian ticketing platform, bilete.ro. The discovery, dated October 15th, 2020, highlighted a significant exposure of user account information. What stood out was the relative lack of robust security measures evident in the leaked data, particularly the presence of plaintext passwords in some instances. The incident was quickly amplified across various underground forums, suggesting a swift and opportunistic exploitation.

The bilete.ro breach, detected on October 15th, 2020, resulted in the exposure of 15,500 records. The compromised data types include Email Address, Username, and alarmingly, Password (in plaintext for a portion of the records) alongside some hashed passwords. The source structure indicates a direct database compromise, potentially through an unpatched vulnerability or weak access controls. The leak location was identified as multiple underground forums, facilitating widespread access to user credentials, thereby increasing the risk of account takeovers and phishing attacks targeting the platform's user base.

While this specific breach did not dominate mainstream tech news, it was discussed within specialized cybersecurity communities and forums focused on Romanian cyber threats. OSINT verification confirms bilete.ro's operational status as a prominent ticketing service. The presence of plaintext passwords is a critical security failure, directly enabling attackers to compromise user accounts without significant effort. This incident serves as a stark reminder of the importance of strong password policies, robust hashing mechanisms, and regular security audits for platforms handling sensitive user credentials, especially those with a large user base and transactional capabilities.