LinkCounter

We've been tracking a resurgence of older breaches appearing in combilists and credential stuffing attacks targeting smaller SaaS platforms. What really struck us wasn't the size of this particular leak, but the fact that it contained plaintext passwords dating back to **2018**. This suggests a continued lack of basic security hygiene at some organizations, and the persistence of these older datasets in underground markets. The implications extend beyond the immediate victim, potentially compromising accounts across multiple services through password reuse.

LinkCounter Breach: 12K Records with Plaintext Passwords Resurface

A breach impacting LinkCounter, a U.S.-based URL tracking and analytics tool, has resurfaced, exposing 12,178 user records. The data, initially leaked in August 2018, includes email addresses and, critically, plaintext passwords. We identified the data while monitoring a popular hacking forum known for hosting combilists used in credential stuffing attacks. What caught our attention was the age of the breach coupled with the extremely poor security practices it revealed.

The presence of plaintext passwords from a 2018 breach is a significant red flag. While password hashing and salting are now considered standard security measures, the fact that LinkCounter stored passwords in plaintext suggests a lack of fundamental security understanding at the time of the breach. This not only endangered LinkCounter's users but also potentially exposed them to risks across other online services if they reused the same passwords.

This breach matters to enterprises now because it highlights the long tail of security risk. Old breaches never truly disappear; they continue to circulate, fueling credential stuffing attacks and account takeovers. The LinkCounter incident is a stark reminder that even seemingly small or outdated breaches can have lasting consequences. It also emphasizes the importance of continuous monitoring for compromised credentials and proactive password resets for affected users.

• Total records exposed: 12,178
• Types of data included: Email Address, Plaintext Password
• Sensitive content types: PII
• Source structure: Unknown
• Leak location(s): Prominent hacking forum (specific URL not included to prevent direct linking to malicious content)
• Date of first appearance: August 26, 2018

External Context & Supporting Evidence

While the LinkCounter breach itself didn't receive widespread media coverage at the time, similar incidents involving plaintext passwords have been reported extensively. For instance, security researcher Troy Hunt maintains a database of breached passwords on Have I Been Pwned (HIBP), which includes numerous instances of plaintext password exposures. The continued appearance of such breaches underscores the persistent threat posed by weak security practices.

OSINT sources indicate that combilists containing older breaches are frequently traded and used in automated credential stuffing attacks. One Telegram post, observed by our team, advertised a "2018-2020 mega-combolist" containing billions of credentials, likely including data from breaches like LinkCounter. These combilists are often used with tools like Sentry MBA and OpenBullet to automate account takeover attempts across a wide range of online services.