EFAR

We noticed a recent aggregation of credentials originating from the EFAR platform, a Singapore-based provider of emergency services and first aid training. The dataset, surfaced on August 26, 2018, comprises approximately 11,000 distinct records. What struck us was the continued prevalence of MD5 hashing for password storage, a practice that significantly diminishes the security posture against modern brute-force and dictionary attacks. The inclusion of email addresses alongside these weakened hashes presents a clear pathway for credential stuffing and targeted phishing campaigns against individuals associated with the organization.

The breach of EFAR, discovered on August 26, 2018, involved a database compromise that exposed 10,913 records. The leaked data primarily consists of email addresses and password hashes, specifically utilizing the MD5 algorithm. This method of password storage is considered obsolete and highly vulnerable, as MD5 hashes can be cracked relatively quickly using readily available tools and rainbow tables. The compromised data was subsequently disseminated on a well-known hacking forum, indicating a potential for broader distribution and exploitation. The threat themes identified are primarily focused on credential stuffing attacks, where the exposed email-password pairs are tested against other online services, and sophisticated phishing operations leveraging the direct association between email addresses and potentially compromised credentials.

External Context

While this specific breach did not generate widespread mainstream news coverage at the time, it aligns with a broader trend of attacks targeting organizations with less robust security infrastructure. The use of MD5 hashing, though dated, was still unfortunately common in many systems in 2018 and continues to be a vulnerability in legacy systems. Security research from organizations like OWASP has consistently highlighted the risks associated with weak hashing algorithms, advocating for stronger, salted hashing functions such as bcrypt or Argon2. The posting of such datasets on prominent hacking forums is a common tactic to facilitate further exploitation by a wider range of malicious actors.