Exhibitoo

We noticed a significant data leak originating from Exhibitoo, an online art gallery and exhibition platform based in the United Kingdom. The breach, discovered on 26-Aug-2018, exposed the credentials of over 7000 users. What struck us was the relatively straightforward nature of the exposed data: email addresses paired with SHA1 hashed passwords. While SHA1 is a deprecated hashing algorithm, its presence in this context still presents a tangible risk, especially when combined with a readily available user base. The subsequent posting of this data on a public hacking forum amplifies the immediate threat landscape.

The Exhibitoo breach involved a database compromise, leading to the exfiltration of 7,120 records. The primary data types exposed were email addresses and password hashes, specifically using the SHA1 algorithm. The source structure of the leak indicates a direct database dump, suggesting a potential vulnerability in the platform's data storage or access controls. The compromised data was subsequently made available on a well-known hacking forum, increasing the likelihood of its use in further malicious activities. This incident falls under the category of a database breach, with the potential for the leaked data to be incorporated into future combolists, thereby broadening its impact beyond the immediate victim pool.

While there was no widespread media coverage for this specific incident at the time of its discovery, the nature of the leak aligns with common trends observed in the OSINT landscape. Breaches involving older hashing algorithms like SHA1 are frequently identified and cataloged by security researchers and data breach aggregators. Such leaks are often precursors to credential stuffing attacks, where attackers systematically attempt to log into other online services using the compromised email/password combinations. The fact that this data appeared on a public forum underscores the ongoing challenges in securing user credentials, particularly when legacy security practices are still in place.