Gaikao

We noticed a recent resurfacing of data attributed to Gaikao, a Taiwanese manufacturer specializing in microcomputer-based controllers and servo motor systems. The initial compromise dates back to August 26, 2018, but the associated data has recently appeared on a prominent cybercrime forum. What struck us was the continued relevance of this older dataset, suggesting potential re-use of credentials or a sustained interest in this particular sector's user base. The breach exposed a significant number of user accounts, raising concerns about the potential for further exploitation.

The Gaikao data breach, impacting 18,362 unique records, primarily involved email addresses and MD5 hashed passwords. The compromised information was discovered circulating on a well-known cybercrime forum, indicating a deliberate dissemination strategy by the threat actors. This type of breach, originating from a database compromise and subsequently packaged as a combolist, is particularly concerning. The use of MD5 hashing, a cryptographically weak algorithm, means that password cracking is a relatively straightforward process for attackers, potentially leading to account takeovers on Gaikao itself or other services where users have reused credentials. The source structure of the leak suggests a direct exfiltration from Gaikao's internal systems.

While there is no widespread news coverage of this specific 2018 Gaikao breach, the presence of such data on active cybercrime forums is a consistent indicator of ongoing threat actor activity. The fact that this data is being re-shared years after the initial compromise highlights the persistence of these marketplaces and the long-term value of compromised credentials. Research into similar breaches affecting industrial control system manufacturers has shown a growing trend of targeted attacks aimed at intellectual property theft and operational disruption. The re-emergence of this Gaikao data aligns with this broader threat landscape.