DualRecrut

We've been tracking the resurgence of older breach datasets in combolists and credential stuffing attacks, a trend that poses a significant risk due to password reuse. What caught our attention with the DualRecrut breach wasn't the size of the leak itself, but the age of the data and the continued use of plaintext passwords. The fact that these credentials – dating back to August 2018 – are still circulating and potentially being used highlights a persistent vulnerability in user security practices and the long tail of data breaches. The accessibility of these older breaches makes them a valuable resource for attackers seeking easy targets.

DualRecrut: The 2018 Leak Still Fueling Credential Stuffing

DualRecrut, a French platform offering career advice and job search guidance, suffered a breach in August 2018 that exposed over 60,000 user records. The breach data surfaced on a well-known hacking forum and includes email addresses and, critically, plaintext passwords. This combination makes the data particularly dangerous, as attackers can directly use the exposed credentials in credential stuffing attacks against other services.

The breach was discovered when the dataset was posted to a hacking forum. The age of the data, combined with the use of plaintext passwords, immediately raised concerns. While the breach itself is not new, its continued relevance as a source for credential stuffing underscores the need for proactive password management and monitoring for compromised accounts.

This breach matters to enterprises because it exemplifies the enduring risk associated with poor password security practices and the long lifespan of compromised data. Even years after a breach occurs, exposed credentials can still be used to gain unauthorized access to accounts and systems. This underscores the importance of implementing robust password policies, multi-factor authentication, and continuous monitoring for compromised credentials.

• Total records exposed: 60,008
• Types of data included: Email Address, Plaintext Password
• Source structure: Likely a database export (specific format unknown)
• Leak location(s): Hacking forum (unspecified)
• Date of first appearance: 26-Aug-2018

External Context & Supporting Evidence

While direct media coverage of the original DualRecrut breach in 2018 appears limited, the broader issue of plaintext passwords and the dangers of combolists are well-documented. Security researcher Troy Hunt's Have I Been Pwned database, which aggregates data breaches, contains the DualRecrut breach, allowing users to check if their email address was exposed. This resource highlights the prevalence of such breaches and the ongoing need for vigilance.

The use of older breaches in combolists is a common tactic. For example, in 2023, BleepingComputer reported on the rise of "combolists" containing billions of stolen credentials, highlighting the continued profitability of these datasets for attackers. These reports emphasize the importance of proactive security measures to protect against credential stuffing attacks.