iMoveis

We noticed an interesting artifact surfacing on a well-trafficked dark web forum, a dataset attributed to the now-defunct Portuguese property listing platform, iMoveis. The leak, dating back to August 2018, appears to be a consequence of a database compromise, with the exposed credentials being particularly concerning due to their plaintext nature. What struck us was the relative obscurity of the platform itself, juxtaposed with the readily available and highly sensitive nature of the leaked credentials, suggesting a potential for credential stuffing attacks against other services.

The iMoveis breach, discovered on or around August 24, 2018, exposed approximately 25,064 records. The core of the compromise lies in the exfiltration of email addresses and, critically, plaintext passwords. This data was subsequently disseminated on a prominent hacking forum, increasing its accessibility to malicious actors. The nature of the leak points towards a direct database intrusion, where the integrity of user credentials was severely compromised. The implications are significant, as the reuse of passwords across different platforms makes this dataset a prime candidate for inclusion in credential stuffing lists, potentially granting attackers access to a multitude of other online accounts belonging to iMoveis users.

While iMoveis is no longer an active entity, the residual impact of this breach continues to pose a risk. Information regarding this specific leak is not widely covered in mainstream cybersecurity news outlets, likely due to its age and the platform's defunct status. However, the presence of such plaintext credentials in public forums is a recurring theme in OSINT investigations and is a known vector for large-scale account takeovers. Researchers have consistently highlighted the dangers of plaintext password storage, underscoring how it amplifies the impact of even older, seemingly minor breaches.