Gumishop

We noticed a significant influx of credential stuffing attempts targeting a subset of our user base shortly after August 26, 2018. This pattern, while not entirely novel, was amplified by the sheer volume and the specific characteristics of the compromised credentials. What struck us was the relatively low pwned count for the source, suggesting a targeted or highly effective initial compromise rather than a broad, indiscriminate dump. The data, originating from a Slovenian e-commerce platform, Gumishop, was disseminated on a well-established cybercrime forum, indicating a deliberate effort to monetize the stolen information.

The Gumishop breach, disclosed on August 26, 2018, impacted 4,158 unique records. The exposed data primarily consisted of email addresses and MD5 hashed passwords. The nature of the compromise points to a direct database exfiltration, with the resulting dataset subsequently being packaged and distributed. The use of MD5 hashing, a known weak cryptographic algorithm, is particularly concerning as it significantly lowers the barrier for attackers to crack the passwords and gain unauthorized access to associated accounts. This breach falls under the category of a database compromise, with the leaked data likely being utilized for the creation of combolists for subsequent credential stuffing operations.

While specific news coverage directly detailing the Gumishop breach at the time of its initial dissemination was limited, the broader trend of e-commerce platform compromises was a persistent theme in cybersecurity discourse. Research from organizations like Troy Hunt's "Have I Been Pwned" has consistently highlighted the prevalence of such breaches and the ongoing risks associated with weak password hashing. The posting of this data on a prominent cybercrime forum suggests it was intended for immediate exploitation by other malicious actors, a common practice following such data exfiltrations.