Dzucker

We've observed a consistent pattern of smaller, older breaches resurfacing in recent months, often repackaged and traded as "new" combolists on various cybercrime forums. This trend poses a persistent credential stuffing risk, particularly for organizations with employees who may have reused passwords across personal and professional accounts. What really struck us about the recent surfacing of the Dzucker breach wasn't the volume of records, but the age and specific niche of the compromised data. The fact that this data, from a defunct online database for a live action role-playing game (LARP) system, is still being actively circulated and potentially used in attacks highlights the long tail of risk associated with seemingly insignificant breaches. The data had been circulating quietly, but we noticed a spike in mentions on a cybercrime forum, prompting a deeper dive.

The Forgotten Realm of Dzucker's Data Breach

The Dzucker data breach, originally occurring in August 2018, involved the exposure of 24,741 email addresses from users of the online database for the Amtgard LARP system. While the breach itself is not new, its recent re-emergence and circulation on a popular cybercrime forum underscores the enduring value of even seemingly innocuous datasets to threat actors. The discovery was triggered by a spike in mentions of "Dzucker" within a specific thread on a forum known for trading combolists, indicating a renewed interest in the compromised data.

The breach caught our attention because of the specific nature of the target: a niche online community for a relatively obscure LARP system. This suggests that the attackers are either casting a wide net in hopes of finding reused credentials, or specifically targeting individuals within this community for reasons related to their interests or potential connections. This matters to enterprises because it demonstrates that any online service, regardless of its size or perceived security, can be a source of compromised credentials that can be leveraged for broader attacks. It also highlights the automation of attacks; reused credentials will be attempted regardless of the source.

• Total records exposed: 24,741
• Types of data included: Email Addresses
• Sensitive content types: None directly. The emails themselves may be linked to personally identifiable information (PII) on other services.
• Source structure: Database, Combolist
• Leak location(s): A popular cybercrime forum.

External Context & Supporting Evidence

While the Dzucker breach itself didn't garner significant mainstream media attention in 2018, its re-emergence aligns with a broader trend of older breaches being repackaged and traded on cybercrime forums. This is often driven by the increasing sophistication of credential stuffing tools and the growing market for compromised credentials. Security researchers have noted a surge in activity on Telegram channels and dark web marketplaces specializing in the sale of combolists, often containing data from older, less-publicized breaches.

One Telegram post claimed the files were part of a larger collection of breached data being sold for a relatively low price, suggesting the attacker is prioritizing volume over individual value. This highlights the economic drivers behind the re-circulation of old breaches and the persistent threat they pose to enterprises.