MBIK

We noticed a recent reappearance of credentials associated with MBIK (Magyar Bútoripari Innovációs Központ Zrt.) on a public hacking forum. This dataset, initially surfaced in August 2018, comprises over 16,000 user records. What struck us was the inclusion of plaintext passwords, a significant vulnerability that elevates the risk of credential stuffing attacks. The nature of the organization, a Hungarian furniture industry innovation center, suggests potential access to sensitive industry data and professional contact information, making this leak a concern for both individual users and the broader sector.

The breach, identified on August 26, 2018, originated from a database compromise at MBIK. A total of 16,283 records were exposed, containing primarily email addresses and, critically, plaintext passwords. This combination points towards a potential direct database exfiltration rather than a sophisticated phishing operation, as the cleartext nature of the passwords suggests a lack of robust encryption at rest. The data was subsequently disseminated as a combolist, a common tactic to facilitate automated login attempts against other online services. The implications are substantial, as compromised credentials can be leveraged for unauthorized access to MBIK's internal systems or to impersonate users across various platforms.

While this specific MBIK breach from 2018 did not garner widespread mainstream news coverage at the time of its initial discovery, similar incidents involving plaintext password exposure are frequently documented. Cybersecurity research consistently highlights the persistent threat of credential stuffing, with organizations like the Identity Theft Resource Center (ITRC) tracking the rising volume of data breaches. The re-emergence of such older, compromised datasets on forums underscores the long-term risks associated with inadequate data security practices and the enduring value of such information to malicious actors.