Free-Rentals

We noticed a significant leak originating from the Free-Rentals platform, discovered on August 26, 2018. What struck us immediately was the inclusion of plaintext passwords alongside MD5-hashed credentials, a concerning oversight in modern security practices. This breach, affecting nearly 5,000 unique records, highlights a persistent vulnerability in how sensitive user authentication data is managed. The exposure on a well-known cybercrime forum suggests immediate exploitation potential for credential stuffing and account takeovers across other services.

The Free-Rentals breach, impacting 4,958 records, appears to stem from a direct database compromise. The exposed data set contains a mix of email addresses and passwords, with a particularly alarming proportion of the latter being in plaintext. The remaining password hashes were generated using the MD5 algorithm, a cryptographic function widely considered insecure and easily reversible. This combination of easily accessible credentials and weak hashing makes the compromised accounts highly susceptible to brute-force attacks and dictionary assaults. The source structure of the leak points towards a direct dump from a primary user database, with no evidence of sophisticated lateral movement or privilege escalation within the network. The leak location on a prominent cybercrime forum indicates that this data is readily available to malicious actors.

While this specific incident involving Free-Rentals did not generate widespread mainstream news coverage at the time, the nature of the exposed data is consistent with numerous similar breaches reported throughout 2018. The use of MD5 hashing and plaintext passwords has been a recurring theme in data leaks, often identified by security researchers and threat intelligence platforms monitoring dark web forums. This type of data is frequently aggregated into combolists, which are then used in widespread credential stuffing campaigns against popular online services. The lack of significant public attention does not diminish the inherent risk to the affected users, as the data remains valuable for attackers seeking to compromise accounts through other means.