Evil Horde Records

We noticed the reappearance of credentials associated with the defunct music label, Evil Horde Records, on a publicly accessible paste site. This resurfacing, nearly five years after the initial compromise, is noteworthy given the age of the data. What struck us was the continued availability of these records despite the platform's dormancy, suggesting a lack of proactive data sanitization or a failure to track historical compromises effectively. The exposed data, while not immediately exploitable for current account takeovers on the original platform, represents a persistent risk for credential stuffing attacks against other services where users may have reused these credentials.

The Evil Horde Records breach, originally occurring around 26-Aug-2018, involved a database compromise that resulted in the exposure of 5914 records. The leaked data primarily consisted of email addresses and MD5 hashed passwords. The compromised information was subsequently disseminated on a prominent hacking forum, indicating a deliberate effort to monetize or distribute the stolen data. This breach falls under the category of a database compromise, with the resulting data likely being incorporated into various combolists used by threat actors. The use of MD5, a notoriously weak hashing algorithm, means that a significant portion of these password hashes could be easily cracked, further amplifying the risk to individuals whose credentials were leaked.

While this specific breach did not generate widespread news coverage at the time of its initial occurrence, its resurfacing on public forums aligns with broader trends of historical data dumps being re-indexed and made accessible. Research from various cybersecurity firms consistently highlights the longevity of leaked credential data and its continued utility in credential stuffing campaigns. The presence of such older datasets underscores the importance of comprehensive data lifecycle management and the ongoing need to monitor for previously compromised information, even from defunct or inactive entities.