Hallgato

We noticed a recent resurgence of interest around a dataset first appearing on a prominent hacking forum in late August 2018. This particular incident involved Hallgato, a Hungarian platform catering to students and campus information. What struck us was the continued availability and potential utility of this older data, particularly given the inclusion of plaintext passwords. The dataset, impacting 26,645 users, presents a clear risk of credential stuffing and unauthorized access to related services.

The breach, attributed to a database compromise, occurred prior to August 26, 2018, with the data surfacing publicly on a hacking forum shortly thereafter. The exposed records consist of 26,645 unique user entries, each containing an email address and, critically, a plaintext password. This lack of encryption for sensitive authentication credentials is the primary vulnerability exploited. The data’s structure suggests a direct dump from a user account database, making it highly valuable for threat actors engaged in credential stuffing campaigns. The leak location was a well-established forum frequented by malicious actors, indicating immediate and widespread dissemination.

While this specific Hallgato breach did not generate significant mainstream news coverage at the time of its initial leak, its characteristics align with common database compromise patterns observed in the cybersecurity landscape. The presence of plaintext passwords in a 2018 leak is unfortunately not an anomaly, but rather a testament to persistent insecure data handling practices. Such datasets are frequently aggregated and sold, or directly utilized in large-scale credential stuffing attacks against other platforms where users reuse credentials. Further OSINT analysis of current dark web marketplaces might reveal if this specific dataset is still being actively traded or utilized.

We've identified a concerning data leak originating from the "Datalife Engine" CMS, affecting an unspecified number of users of a Russian-language forum focused on car enthusiasts. The breach, which occurred sometime in late 2017, was discovered when a substantial dataset containing user credentials and personal information began circulating on dark web marketplaces in early 2018. What is particularly alarming is the inclusion of hashed passwords, but with a weak hashing algorithm, making them susceptible to brute-force attacks, alongside other sensitive personal identifiers. The persistence of this data and its potential for exploitation remain a significant concern.

The incident involved a compromise of a website utilizing the Datalife Engine Content Management System. While the exact number of affected users is not definitively stated in the available data, the leaked dataset is substantial. It comprises email addresses, usernames, and crucially, hashed passwords. The hashing algorithm employed appears to be an older, less secure variant, rendering it vulnerable to offline cracking attempts. In addition to credentials, the leak also includes IP addresses and registration dates, providing threat actors with valuable reconnaissance information for targeted attacks. The data was found on multiple dark web forums, indicating broad distribution and accessibility to malicious actors.

This Datalife Engine CMS compromise echoes a broader trend of vulnerabilities found in older or less actively maintained web platforms. While specific news coverage of this particular forum breach is limited, research into Datalife Engine vulnerabilities has highlighted past instances of SQL injection and other exploits that could have led to such data exfiltration. The use of weak hashing algorithms has been a long-standing security concern, and datasets like this serve as a stark reminder of the necessity for modern, robust password hashing practices. The inclusion of IP addresses further amplifies the risk, potentially aiding in the identification and targeting of specific users.

Our analysis has uncovered a significant data exposure event impacting "MyHeritage," a prominent genealogy platform. The breach, which occurred in late October 2017, was not initially characterized by a direct hacking of user accounts but rather by the unauthorized access to a third-party marketing database. What stands out is the sheer scale of the exposure, encompassing a vast number of email addresses, and the potential for sophisticated social engineering attacks given the nature of the platform. The lack of direct password compromise in this instance shifts the risk profile but does not diminish the overall threat.

The breach involved unauthorized access to a third-party database used by MyHeritage for marketing purposes, discovered on November 1, 2017. This access resulted in the exposure of 92,284,838 records, primarily consisting of email addresses. While passwords were not directly compromised from this specific database, the sheer volume of exposed emails presents a substantial risk. The source of the breach is understood to be an external vendor, indicating a potential supply chain vulnerability. The data was reportedly found on a private server, and while not widely disseminated on public forums, its existence has been confirmed through various cybersecurity intelligence feeds.

The MyHeritage breach garnered significant media attention due to the platform's large user base and the sensitive nature of genealogical data. News outlets reported extensively on the incident, highlighting the potential for phishing and spear-phishing attacks leveraging the exposed email addresses. Security researchers have noted that while passwords were not directly exposed in this instance, the correlation of these emails with other publicly available data could enable highly targeted social engineering campaigns. This incident underscores the critical importance of vetting third-party vendors and ensuring robust data security practices throughout the entire data lifecycle, even for seemingly non-critical marketing databases.