Find a Carer

We noticed an unusual surge in credential stuffing attempts targeting several of our user-facing applications, prompting an immediate investigation. What struck us was the consistent pattern of compromised credentials originating from a single, albeit dated, source. This particular breach, dating back to early 2018, involved a platform primarily used for connecting individuals with care services. The relatively low number of affected records might initially seem insignificant, but the nature of the exposed data and its subsequent dissemination warrant closer examination.

The breach, which occurred on February 7, 2018, impacted the Australian platform "Find a Carer." Approximately 14,782 records were compromised, exposing email addresses and password hashes (specifically MD5). The data was later found circulating on a prominent hacking forum, suggesting its integration into broader credential stuffing operations. The source structure points to a direct database compromise, where the hashing algorithm used, MD5, is particularly susceptible to brute-force attacks and rainbow table lookups, making these credentials highly exploitable even after a decade. The threat theme here is clear: outdated hashing mechanisms and the long-term persistence of leaked credentials in the underground economy.

While this specific breach did not generate significant mainstream news coverage at the time, its presence on public hacking forums is a recurring theme in cybersecurity research. Databases of compromised credentials, even from smaller or older incidents, are routinely aggregated and sold, forming the backbone of large-scale credential stuffing campaigns. The continued exploitation of MD5-hashed passwords, as highlighted by numerous security advisories over the years, underscores the persistent risk posed by legacy security practices. Organizations like the Australian Cyber Security Centre (ACSC) have consistently warned about the dangers of weak password hashing and the importance of regular data hygiene.