LondonRunner

We've observed a consistent pattern of older breaches resurfacing in recent months, often repackaged in new combolists or leveraged in credential stuffing attacks. What really struck us about this particular incident wasn't the scale—it was relatively small—but the age of the data and the specific demographic targeted. The LondonRunner breach, dating back to February 2018, involved a relatively niche community of runners in London, Ontario. The fact that this data is still circulating and potentially being used highlights the long tail of risk associated with even seemingly minor breaches.

The LondonRunner Breach: 17,592 Records of Running Community Members Exposed

In February 2018, the Canadian website LondonRunner, a hub for the running community in London, Ontario, suffered a data breach. The breach exposed the data of 17,592 users. The compromised information, including email addresses and MD5 password hashes, recently resurfaced on a prominent hacking forum. While MD5 is a weak hashing algorithm by today's standards, the age of the breach and the potential for password reuse make this a relevant threat for enterprises to consider.

The breach was discovered when the dataset was leaked on a well-known hacking forum. While the initial breach occurred over six years ago, the re-emergence of this data suggests that it is still considered valuable by threat actors. The focus on a specific geographic location and community also raises the possibility of targeted attacks against individuals or organizations connected to the LondonRunner user base.

This breach matters to enterprises because it exemplifies the enduring risk of older data breaches. Even if a breach occurred years ago and was seemingly contained, the compromised credentials can still be used in credential stuffing attacks or to gain access to other accounts. The MD5 hashing algorithm is crackable with today's computing power. This highlights the need for continuous monitoring of leaked credentials and proactive password resets for users who may have been affected by this or similar breaches.

• Total records exposed: 17,592
• Types of data included: Email Addresses, Password Hashes (MD5)
• Sensitive content types: Potentially personal information related to running activities and club memberships.
• Source structure: Database, Combolist
• Leak location(s): Prominent hacking forum (specific URL unavailable due to ongoing forum monitoring restrictions)
• Date of first appearance: 07-Feb-2018 (date of initial breach, resurfaced recently)

As noted by HaveIBeenPwned, this breach occurred on February 7, 2018, and has been added to their database. This allows individuals to check if their email address was among those compromised. HaveIBeenPwned Link

The re-emergence of the LondonRunner breach is a reminder of the persistent threat posed by older data leaks. Even breaches targeting smaller, niche communities can have lasting consequences, especially when weak hashing algorithms are used. Enterprises should remain vigilant in monitoring for leaked credentials and proactively mitigating the risks associated with password reuse.