FJ Pergaminos

We noticed a concerning data leak originating from FJ Pergaminos, a niche e-commerce platform. The breach, discovered on August 26, 2018, exposed a significant portion of their user base. What struck us was the relatively low pwned count of 4,490 records, yet the inclusion of password hashes, a persistent risk even with older hashing algorithms. The nature of the compromised data suggests a direct database exfiltration, rather than a credential stuffing attack, which warrants closer examination of their database security posture.

The breach of FJ Pergaminos, a Spanish vendor of artisanal diplomas and genealogical art, resulted in the exposure of approximately 4,490 unique email addresses and their associated **MD5 hashed passwords**. The data, totaling around 6,000 records, was disseminated on a well-known hacking forum, indicating a deliberate act of data theft and subsequent public disclosure. The use of MD5, a demonstrably weak hashing algorithm, means that these password hashes are highly susceptible to brute-force attacks and rainbow table lookups, posing a direct and immediate risk to the affected users. The source structure points to a direct database dump, highlighting a potential vulnerability in FJ Pergaminos' data storage and access controls. This incident falls under the category of a database breach, with the leaked data subsequently being incorporated into credential stuffing lists.

While this specific breach did not generate widespread mainstream news coverage at the time, the nature of the compromised data – email addresses and hashed passwords – aligns with common threat actor objectives. The availability of such data on hacking forums is a well-documented phenomenon, often serving as fodder for subsequent credential stuffing campaigns against other platforms where users may have reused credentials. Research into the security practices of e-commerce platforms, particularly those handling personal identifiable information and transactional data, consistently highlights the risks associated with outdated cryptographic methods like MD5.