French Property Links

We noticed a significant influx of credential stuffing attempts targeting a broad range of online services originating from a specific IP range. Further investigation revealed a correlation between these attempts and a previously dormant database. What struck us was the sheer volume of plaintext passwords alongside email addresses, indicating a low-effort exfiltration and subsequent repurposing of user credentials. This particular dataset, originating from the now-defunct French Property Links, highlights a persistent threat vector that continues to yield valuable, albeit aged, credentials for malicious actors.

The compromise of French Property Links, which occurred around August 21, 2018, resulted in the exposure of 11,974 unique records. The breach, categorized as a database compromise, yielded sensitive user information including email addresses and plaintext passwords. The lack of any discernible encryption or hashing for the password field suggests a fundamental security oversight on the platform's part. This data was subsequently disseminated on a well-known hacking forum, likely contributing to its inclusion in various combolists that fuel ongoing credential stuffing operations. The fact that this data is still actively being utilized over four years post-breach underscores the longevity of such leaks in the underground economy.

While this specific breach did not garner widespread mainstream media attention at the time, it aligns with a pattern of similar incidents involving smaller, niche online platforms that often become repositories for easily exploitable user data. Research into historical data breaches reveals that platforms catering to specific regional markets or industries are frequently targeted due to a perceived lower security posture. The availability of such datasets on dark web marketplaces is a well-documented phenomenon, consistently exploited by threat actors for financial gain through account takeovers and further malicious activities.