G2C

We noticed a significant influx of credentials associated with the French consulting firm, G2C, appearing on a well-established cybercrime forum. The discovery, occurring on August 26, 2018, revealed a dataset containing nearly 10,000 unique email addresses and their corresponding password hashes. What struck us was the relatively low pwned count of 9,559, suggesting a targeted extraction or a specific subset of their user base was affected, rather than a broad, indiscriminate dump. The data's presence on a public forum indicates a potential for widespread credential stuffing attacks against G2C's users and associated services.

The breach breakdown indicates a database compromise, where an attacker gained unauthorized access to G2C's internal systems. The leaked data comprises 9,559 records, primarily consisting of email addresses and their associated MD5 password hashes. The source structure of this leak points to a direct extraction from a database, likely a user or customer directory. The data was subsequently published on a prominent cybercrime forum, making it readily accessible to malicious actors. The use of MD5 hashing, a known weak cryptographic algorithm, means that these password hashes are highly susceptible to offline cracking, further amplifying the risk to affected individuals.

While specific news coverage directly detailing the G2C breach at the time of discovery was limited, the appearance of such datasets on cybercrime forums is a common precursor to broader security incidents. The presence of G2C credentials on these platforms often correlates with an increase in credential stuffing attempts against other online services where users may have reused their passwords. Further OSINT investigation into the forum where the data was posted could reveal discussions or claims of responsibility, potentially offering insights into the attacker's methodology and motivations. The firm, now operating as Altereo, would have faced significant reputational damage and potential regulatory scrutiny depending on the nature of the exposed data and the jurisdiction.