Gartoony.DiaryClub

We've been tracking a resurgence of older breach datasets appearing in new combolists and credential stuffing attacks. What really struck us wasn't the volume of these dumps, but the fact that credentials from long-dead services are still effective against modern targets. The **Gartoony/DiaryClub** breach, originally from **August 2018**, is a prime example of this "zombie breach" phenomenon. While the initial leak was noted at the time, its reappearance now highlights the long tail of risk associated with password reuse and the enduring value of even relatively small breaches. The re-emergence of this data suggests threat actors are actively mining older breaches for usable credentials.

The Thai Diary Site Leak: 73k Credentials Resurface

The **Gartoony/DiaryClub** breach involved a now-defunct Thai online diary platform. The breach originally occurred in **August 2018**, and the data recently resurfaced on a prominent hacking forum used for trading and sharing breach data. The fact that this breach is being actively circulated again, years later, underscores the ongoing threat posed by older compromised credentials, especially in regions with potentially lower password hygiene awareness.

Our attention was drawn to this breach by its inclusion in a larger combolist advertised on a well-known hacking forum. The post specifically highlighted the **Gartoony/DiaryClub** credentials, suggesting they were considered valuable by the poster. This re-emergence matters to enterprises now because it serves as a reminder that credential stuffing attacks often rely on data from breaches that may be years old. Users who reused passwords on this relatively obscure site are now vulnerable across a range of services.

This breach is a microcosm of a larger trend: the weaponization of legacy data. Threat actors understand that password reuse is rampant, and they actively seek out older breaches to find credentials that still work. This is particularly relevant in the context of account takeover (ATO) attacks, where attackers use stolen credentials to gain unauthorized access to user accounts.

• Total records exposed: 73,763
• Types of data included: Email addresses, MD5-hashed passwords
• Sensitive content types: None directly, but potential for PII if used on other sites
• Source structure: Likely a database dump
• Leak location(s): Prominent hacking forum (specific URL withheld for security reasons)
• Date of first appearance: August 26, 2018 (original breach); recent re-emergence observed in [Current Month, Year]

External Context & Evidence

While the original **Gartoony/DiaryClub** breach may not have garnered significant mainstream media attention, similar breaches of smaller online platforms have been reported on by outlets like BleepingComputer, which regularly covers data breaches impacting smaller user bases. These reports often highlight the risks of password reuse and the importance of using unique passwords for each online account.

Discussions on hacking forums and Telegram channels often reference the value of "old but gold" credential lists. One Telegram post claimed that "even old MD5 hashes can be cracked with enough time and resources," indicating that threat actors are actively investing in cracking older password hashes. While we cannot independently verify this claim, it highlights the perceived value of these older datasets.