Elvinelol

We've been tracking the resurgence of older forum breaches appearing in aggregated data dumps, often repackaged and resold on Telegram channels. What caught our attention with the recent surfacing of the Elvinelol data wasn't the size of the breach itself – just over 10,000 accounts – but its age and the continued relevance of even dated credentials. The fact that these records, originating from 2016, are still being actively traded and potentially used in credential stuffing attacks underscores the long tail of risk associated with legacy breaches. The low-security hashing algorithm used to store the passwords at the time further amplifies the risk.

The World of Warcraft Forum Breach: 10k Accounts Resurface

The Elvinelol breach, affecting a World of Warcraft-related forum, was discovered within a larger collection of forum database dumps circulating on a popular breach aggregation site on September 14th, 2024. While the total number of records (10,703) is relatively small compared to more recent breaches, the age of the data and the weak hashing algorithm used to protect passwords made it noteworthy. The data had been circulating quietly, but we noticed an uptick in mentions within several Telegram channels known for trading older breach compilations. This breach highlights the ongoing risk posed by older, less-publicized incidents, particularly when weak or outdated security practices were in place. It is a reminder that even seemingly minor breaches can have lasting consequences as attackers continue to leverage exposed credentials for years to come. This also ties into the broader threat theme of credential harvesting and account takeover attempts.

• Total records exposed: 10,703
• Types of data included: Email Address, Password Hash, Username, IP Address
• Sensitive content types: Password Hashes
• Source structure: Database Dump
• Leak location(s): Breach Forums, Telegram Channels
• Date Leaked: February 1, 2016

The use of vBulletin hashes, a relatively weak hashing algorithm, significantly increases the risk associated with this breach. While not directly confirmed, similar vBulletin breaches have been covered by sites like BleepingComputer, highlighting the general vulnerability of forums using this software with default configurations. The continued circulation of these older databases is a testament to the enduring value of even outdated credentials for attackers seeking to compromise accounts through password reuse.