FTOR

We noticed a recent resurgence of interest in a dataset originating from the now-defunct German financial platform, FTOR. The initial discovery of this breach dates back to August 26, 2018, with the data surfacing on a well-known hacking forum. What struck us was the persistent use of this particular dataset in credential stuffing attacks, even years after its initial exposure and the platform's subsequent closure. The relatively low pwned count of 8,234 records might suggest a limited initial impact, but the longevity and continued exploitation of these credentials highlight a critical vulnerability in how organizations handle legacy data and the enduring threat posed by credential stuffing.

The FTOR breach, discovered in late August 2018, involved a database compromise that exposed approximately 8,234 records. The leaked data primarily consists of email addresses and their corresponding MD5 hashed passwords. The hashing algorithm, MD5, is now considered cryptographically weak and highly susceptible to brute-force attacks and rainbow table lookups, significantly increasing the risk of password cracking. This exposure is particularly concerning as it likely contributed to a larger combolist, a common tactic employed by threat actors to automate login attempts across multiple services. The source structure of the leak points to a direct database exfiltration, suggesting a potential SQL injection vulnerability or compromised database credentials were the initial entry points. The data was subsequently disseminated on a prominent hacking forum, making it readily accessible to a wide range of malicious actors.

While this specific FTOR breach did not generate widespread mainstream news coverage at the time of its discovery, its inclusion in larger combolists has been indirectly referenced in various OSINT reports and cybersecurity analyses concerning credential stuffing campaigns. The continued availability and use of these credentials underscore a broader industry challenge: the long-term impact of data breaches, even from smaller or defunct entities. Research from organizations like the Identity Theft Resource Center (ITRC) consistently highlights credential stuffing as a primary attack vector, and datasets like the one from FTOR, despite their age, remain valuable assets for attackers engaging in such activities.