Hire Scores

We noticed a significant influx of credential stuffing attempts targeting a subset of our user base shortly after August 21, 2018. This pattern, while not entirely novel, became particularly noteworthy due to its correlation with a publicly disclosed breach impacting a now-defunct recruitment directory, Hire Scores. What struck us as particularly concerning was the inclusion of plaintext passwords within the leaked dataset, a practice that significantly amplifies the risk of downstream compromise across other platforms. The scale of the leak, while not in the millions, is substantial enough to warrant immediate attention, especially given the nature of the exposed credentials.

The Hire Scores breach, which surfaced on August 21, 2018, exposed 11,645 unique records. Analysis of the leaked data revealed a straightforward database dump containing email addresses and plaintext passwords. This type of breach, often referred to as a "combolist" leak, is particularly insidious as it facilitates automated attacks. Threat actors can systematically test these credential pairs against numerous online services, exploiting the common practice of password reuse. The source structure indicates a direct extraction from a relational database, with the leak originating from a known cybercrime forum, a common distribution point for such compromised information.

While Hire Scores itself is no longer operational, the implications of this 2018 breach continue to resonate. The exposure of plaintext passwords, a practice that should have been obsolete by that time, highlights a persistent vulnerability in data handling practices. This incident is not an isolated event; numerous similar breaches involving compromised credentials from various online services have been documented over the years. Researchers have consistently warned about the dangers of password reuse and the cascading effects of even seemingly minor data leaks. The continued availability of such combolists on dark web forums underscores the long-term threat posed by these types of compromises.