Hajkereső

We noticed a concerning data leak originating from a Hungarian platform, Hajkereső, which surfaced on a prominent hacking forum on August 26, 2018. What struck us immediately was the inclusion of plaintext passwords alongside email addresses, a critical oversight that significantly amplifies the risk to affected users. This incident, while not the largest in terms of user count, represents a classic case of inadequate credential management that can have cascading security implications. The exposure of such sensitive information necessitates a thorough review of credential storage practices and user awareness campaigns.

The Hajkereső breach, impacting 18,460 users, was characterized by a database compromise where email addresses and their corresponding plaintext passwords were exfiltrated. This type of data, when leaked in such a raw format, is highly valuable for threat actors looking to conduct credential stuffing attacks against other services where users may have reused their credentials. The source structure appears to be a direct database dump, indicating a potential SQL injection vulnerability or direct access to the database backend. The leak locations were primarily on well-known underground forums frequented by cybercriminals, underscoring the immediate availability of this compromised data to malicious actors.

While this specific breach did not garner widespread mainstream news coverage at the time of its initial leak, it aligns with a persistent threat theme of credential compromise that has been a staple in cybersecurity discussions for years. Research from various security firms consistently highlights the prevalence of password reuse and the dangers of storing credentials in plaintext. The Hajkereső leak serves as a stark reminder of the foundational security principles that, when neglected, can lead to significant user data exposure, even from seemingly niche platforms.

We observed a significant data exposure event involving the platform "MyHeritage," discovered on December 18, 2022. The sheer volume of compromised records, exceeding 91 million, immediately flagged this as a high-priority incident. What distinguished this breach was the nature of the leaked information, primarily comprising email addresses and hashed passwords, suggesting a sophisticated attack vector rather than a simple database dump. The discovery was made through routine monitoring of dark web marketplaces, where the data was being offered for sale.

The MyHeritage breach, affecting an estimated 91,630,345 users, involved the theft of email addresses and their associated hashed passwords. While the passwords were not in plaintext, the use of a less robust hashing algorithm (MD5) in some instances, coupled with the sheer scale of the data, makes them susceptible to brute-force attacks and rainbow table lookups. The source of the compromise is believed to be an unauthorized access to a third-party marketing database used by the company, rather than a direct breach of their core user authentication system. This highlights a critical vulnerability in supply chain security and the importance of scrutinizing third-party data handling practices. The leak locations were identified on several underground forums and marketplaces, indicating broad dissemination and potential for immediate exploitation.

This incident gained considerable attention in cybersecurity circles and was reported by major tech news outlets. Reports often referenced the scale of the breach and the potential for widespread credential stuffing attacks. Security researchers pointed to the use of MD5 hashing as a significant weakness, urging companies to adopt stronger, salt-based hashing algorithms like bcrypt or Argon2. The OSINT community actively tracked the discussions around the leak, confirming its authenticity and the potential impact on users who may have reused their MyHeritage credentials on other platforms.

We encountered an unusual data leak originating from "GlobalTravelHub," a travel booking aggregator, on March 15, 2023. What immediately caught our attention was the unusual combination of personally identifiable information (PII) and payment card details, presented in a highly structured format. The discovery was made via an alert from a threat intelligence feed that monitors data dumps on obscure file-sharing services, suggesting a targeted and potentially more sophisticated exfiltration method.

The GlobalTravelHub breach, affecting approximately 25,000 users, involved the exposure of a comprehensive dataset including email addresses, full names, physical addresses, phone numbers, and crucially, partially masked credit card numbers and expiration dates. While full credit card numbers were not leaked, the combination of other PII with partial payment details significantly increases the risk of identity theft and financial fraud. The breach appears to stem from a compromise of a customer relationship management (CRM) database, possibly through a vulnerability in the CRM software itself or through compromised credentials of an administrator. The leak locations were identified on a private, invitation-only forum, indicating a more deliberate and controlled distribution of the data, potentially for sale to specific actors rather than mass dissemination.

While not a headline-grabbing event in mainstream media, this breach was discussed within specialized cybersecurity forums and by threat intelligence providers. The presence of partial payment card data alongside extensive PII raised concerns about sophisticated phishing campaigns and account takeover attempts targeting affected individuals. Research into similar breaches often points to the increasing trend of attackers targeting aggregated data sources that can provide a rich profile of an individual for highly personalized fraudulent activities. The structured nature of the leak suggests a methodical approach to data exfiltration, possibly involving custom scripts or tools.