Dobro

We noticed an unusual spike in credential stuffing attempts targeting a variety of retail and e-commerce platforms originating from IP addresses associated with a recent data leak. Further investigation revealed a substantial dataset impacting the Russian volunteer and civic engagement platform, Dobro, surfaced on September 30, 2024. What struck us was the relatively straightforward nature of the compromise, likely stemming from a common vulnerability, yet the sheer volume of personally identifiable information (PII) and credential material exposed presents a significant risk for downstream attacks. The inclusion of salted MD5 password hashes, while a known weakness, is particularly concerning given the prevalence of password reuse.

The Dobro breach, disclosed on September 30, 2024, exposed approximately 649,524 records. The dataset, reportedly originating from a database compromise, contains a comprehensive suite of user information including email addresses, phone numbers, first and last names, and birthdays. Crucially, the leak also includes MD5 hashed and salted passwords, a format that, while not plaintext, is susceptible to offline brute-force attacks and rainbow table lookups, especially when combined with readily available PII for credential stuffing. The information was disseminated via a Telegram channel, a common vector for illicit data sharing, increasing the immediate accessibility for malicious actors. The implications are broad, ranging from identity theft and targeted phishing campaigns to the exploitation of volunteer networks for further malicious endeavors.

News of the Dobro leak has been circulating within cybersecurity communities and has been noted by several OSINT researchers monitoring data dumps. While mainstream media coverage is currently limited, the dataset's presence on Telegram suggests a rapid dissemination among threat actors. Research into MD5 hashing weaknesses continues to highlight its inadequacy as a modern security measure, with numerous studies demonstrating the ease with which even salted hashes can be cracked. This incident serves as a stark reminder of the ongoing risks associated with outdated cryptographic practices and the persistent threat of data exfiltration from online platforms, regardless of their civic or social mission.