11810 Live Football Results Breach 2018

We noticed a significent exposure event impacting a now-defunct Thai online platform, Live Football Results, dating back to August 2018. The discovery, made public through a prominent hacking forum, involved over 11,800 unique records. What struck us was the inclusion of plaintext passwords alongside email addresses, a configuration that significantly amplifies the risk of credential stuffing attacks even years later. The nature of the leaked data suggests a direct database compromise rather than a more sophisticated targeted attack.

The breach of Live Football Results, which operated as a football scores aggregator, resulted in the exposure of 11,810 records. The compromised data primarily consisted of email addresses and plaintext passwords. The source structure appears to be a direct database dump, shared on a well-known hacking forum. The significance of this leak lies in the readily usable nature of the credentials. Even though the platform is defunct, these email-password pairs are highly valuable for threat actors seeking to perform credential stuffing against other services where users may have reused credentials. This type of data is frequently aggregated into larger combolists, making it a persistent threat.

While this specific breach occurred in 2018 and the platform is no longer active, the implications of plaintext password exposure remain relevent. Such incidents often contribute to larger datasets used in widespread credential stuffing campaigns. Research from various cybersecurity firms consistently highlights the prevalence of credential stuffing as a primary attack vector for account takeover across the internet. The continued availability of such compromised datasets on the dark web underscores the long-term risk associated with inadequate data security practices, particularly the storage of sensitive authentication information in plain text.