FFXI Accounts

We've been tracking the re-emergence of older breach datasets in combolists and credential stuffing attacks, and a recent sample caught our eye due to its age and the continued relevance of gaming accounts. What stood out wasn't the size of the 180,780 records, but the fact that the passwords were stored in plaintext. This points to outdated security practices and a potential goldmine for attackers looking to reuse credentials across multiple platforms. The data had been circulating quietly for years, but we noticed a spike in mentions on several underground forums, suggesting renewed interest in this particular dataset.

FFXI Accounts Breach: Plaintext Passwords Fuel Credential Stuffing

A breach at FFXI Accounts, a now-defunct online marketplace for Final Fantasy XI accounts, exposed 180,780 user records in June 2019. The data, which surfaced on a prominent hacking forum, included email addresses and, critically, plaintext passwords. The lack of password hashing or salting is a major security lapse, making these credentials especially valuable for attackers.

Our team discovered this breach while monitoring combolists being traded on various forums and Telegram channels frequented by credential stuffing actors. The age of the breach and the plaintext nature of the passwords made it particularly noteworthy. It's uncommon to see such blatant disregard for basic security practices in a breach of this size, even several years ago.

The breach matters to enterprises because it highlights the long tail of risk associated with compromised credentials. Even though FFXI Accounts is no longer operational, the exposed email/password combinations are likely still valid on other platforms, particularly those with less stringent security measures. This increases the risk of account takeover attacks targeting employees who may have reused these credentials.

This incident underscores the persistent threat of credential reuse and the continued effectiveness of credential stuffing attacks, especially when combined with older, poorly secured datasets. It also highlights the importance of regularly monitoring for leaked credentials associated with your organization's domain and encouraging employees to use unique, strong passwords across all their accounts.

• Total records exposed: 180,780
• Types of data included: Email addresses, plaintext passwords
• Sensitive content types: Gaming account credentials
• Source structure: Not specified, likely a database export
• Leak location(s): Prominent hacking forum
• Date of first appearance: June 12, 2019

External Context & Supporting Evidence

While specific news coverage of the FFXI Accounts breach is limited, the broader trend of plaintext password storage and its implications have been widely reported. Security researcher Troy Hunt, creator of Have I Been Pwned?, has frequently discussed the dangers of storing passwords in plaintext and the impact on credential stuffing attacks. The Have I Been Pwned? website itself includes the FFXI Accounts breach in its database of compromised accounts, allowing users to check if their email address was affected.

Discussions on various forums and Telegram channels indicate that the FFXI Accounts data has been actively used in credential stuffing campaigns targeting online gaming platforms and other services. One Telegram post, observed by our team, specifically mentioned using the dataset to gain access to accounts on a popular streaming service.