Il Forno NYC

We noticed a recent aggregation of credentials surfacing on a public forum, specifically linked to the online booking system of Il Forno NYC. What struck us was the immediate accessibility of plaintext passwords, a configuration that bypasses even basic hashing protections. The discovery was made through routine monitoring of credential dumps, revealing a dataset that, while not massive in absolute terms, represents a significant risk due to its direct usability for account takeover. The age of the leak, August 2018, suggests this is likely residual data being recirculated or repurposed rather than a fresh compromise, but its presence demands attention given the potential for credential stuffing attacks.

The incident, dating back to August 21, 2018, involved a database breach affecting the online booking platform for Il Forno NYC. Approximately 16,777 records were compromised, with a significant portion containing both email addresses and plaintext passwords. This direct exposure of credentials is a critical vulnerability, enabling attackers to bypass authentication mechanisms with minimal effort. The data was subsequently posted on a well-known hacking forum, increasing its reach and potential for exploitation. The nature of the breach points towards a database compromise, with the leaked data likely forming part of a larger combolist used for automated credential stuffing campaigns across various online services.

While this specific incident concerning Il Forno NYC did not generate widespread mainstream news coverage at the time of its occurrence, it aligns with broader trends in the restaurant and hospitality sector. Numerous smaller businesses, particularly those relying on third-party booking platforms or less robust internal security, have become targets for data exfiltration. Research from cybersecurity firms has consistently highlighted the vulnerability of such entities to credential stuffing and phishing attacks, often due to the reuse of passwords across multiple services. The presence of plaintext passwords in this leak is a stark reminder of the ongoing challenges in enforcing secure credential storage practices even years after the initial compromise.