Fundación Aragón Emprende (Aragón Entrepreneurship Foundation)

We noticed a recent resurgence of interest in a 2018 data leak originating from Fundación Aragón Emprende. This breach, which occurred on August 26, 2018, involved the exposure of user credentials. What struck us was the continued presence and potential repurposing of this dataset within threat actor communities, despite its age. The nature of the exposed data, specifically email addresses paired with password hashes, presents a persistent risk for credential stuffing attacks against other platforms. The relatively low pwned count of 5,635 records, while not massive, represents a significant portion of the organization's user base at the time, and the availability of this information on public forums warrants renewed attention.

The breach originated from a database compromise, with the resulting data appearing on a prominent hacking forum. The dataset contained 5,635 records, each comprising an email address and an MD5 password hash. The primary threat vector here is the potential for credential stuffing. Threat actors can leverage lists of compromised email addresses and their corresponding hashes to attempt logins on other services, exploiting password reuse practices common among users. The MD5 hashing algorithm, while considered weak by modern standards, is still susceptible to brute-force attacks and rainbow table lookups, especially for common or easily guessable passwords. The fact that this data has been available for several years suggests it may have been incorporated into larger, more comprehensive combolists, increasing its utility for attackers.

While this specific incident did not garner widespread mainstream media attention at the time of its discovery in 2018, older breaches of this nature are frequently aggregated and sold on dark web marketplaces. OSINT investigations into similar breaches often reveal patterns of data being reused across various threat actor operations. Research into the effectiveness of credential stuffing attacks consistently highlights the significant impact of even moderately sized, older datasets when combined with modern brute-forcing techniques. The continued availability of such data underscores the enduring value of compromised credentials in the cybercriminal ecosystem.