Los Ninos

We noticed a recent resurgence of activity around a dataset originating from Los Ninos, a Belgian platform catering to the LGBT community. The breach, initially discovered in August 2018, has resurfaced on a prominent cybercrime forum, indicating potential reuse or renewed interest from malicious actors. What struck us was the persistence of this older dataset, suggesting that even seemingly niche platforms can become targets for credential stuffing or other opportunistic attacks. The nature of the exposed data, specifically email addresses and password hashes, makes it a prime candidate for credential stuffing campaigns against other services.

The Los Ninos breach, first documented on August 26, 2018, exposed 56,224 unique records. The compromised data primarily consisted of email addresses and MD5 hashed passwords. These records were subsequently posted on a well-known cybercrime forum, facilitating their acquisition by a wider audience of threat actors. The nature of the breach, identified as a database compromise, suggests a direct infiltration of the platform's data stores. The subsequent appearance of these credentials in what are often referred to as "combolists" amplifies the risk, as these lists are frequently used in automated brute-force attacks against other online services.

While there was no significant mainstream news coverage surrounding the initial Los Ninos breach, its reappearance on cybercrime forums is a common indicator of ongoing threat actor activity. OSINT investigations into similar past breaches of community-focused platforms reveal a consistent pattern of targeting user credentials for broader exploitation. Research from cybersecurity firms has repeatedly highlighted the efficacy of credential stuffing attacks utilizing data from older, less secure breaches, underscoring the enduring threat posed by such exposures.

Our attention was drawn to a significant data leak impacting a platform known as "Los Ninos," a Belgian entity serving the LGBT community. The initial discovery of this incident dates back to August 2018, but recent activity suggests a renewed interest or potential redistribution of the compromised information. What is particularly noteworthy is the continued availability and potential exploitation of this dataset, even years after its initial exposure. This highlights the long-term implications of even seemingly smaller-scale breaches.

The Los Ninos incident, documented on August 26, 2018, resulted in the exposure of 56,224 records. The core of the compromised data comprises email addresses and MD5 hashed passwords. These credentials were made available on a prominent cybercrime forum, significantly increasing their accessibility to malicious actors. The breach is categorized as a database compromise, indicating a direct intrusion into the platform's data storage. The subsequent aggregation of this data into combolists is a critical factor, as these compiled lists are a primary tool for automated credential stuffing operations targeting a wide array of online services.

There was limited public reporting on the Los Ninos breach at the time of its discovery. However, the recurring presence of such datasets on dark web marketplaces and forums is a well-established phenomenon. Analysis of similar historical breaches targeting niche online communities often reveals a pattern of credential harvesting, which is then leveraged for fraudulent activities or to gain access to other user accounts through password reuse.

We've identified a persistent threat stemming from a data breach that occurred on the Los Ninos platform, a Belgian site catering to the LGBT community. The initial discovery of this incident was in August 2018, but its continued presence and potential for exploitation remain a concern. What stands out is the relatively straightforward nature of the exposed data and its high utility for automated attacks, even after a significant passage of time. This breach serves as a stark reminder of the enduring value of even seemingly dated credential information.

The Los Ninos breach, first observed on August 26, 2018, involved the exfiltration of 56,224 records. The exposed data is limited to email addresses and MD5 hashed passwords. This information was disseminated on a notable cybercrime forum, making it readily available for acquisition. The underlying cause is classified as a database compromise, suggesting unauthorized access to the platform's core data repositories. The subsequent inclusion of these credentials in various combolists is a significant concern, as these compiled datasets are routinely employed in large-scale credential stuffing campaigns.

Public reporting on the Los Ninos breach was minimal at the time of its occurrence. However, the cybersecurity landscape is replete with examples of older breaches being exploited. Threat intelligence reports consistently indicate that attackers actively search for and utilize credentials from previously compromised databases to target users across multiple platforms, leveraging the prevalent practice of password reuse.