MCQforall

We noticed a dataset surfacing on a well-known hacking forum on August 26, 2018, originating from an Indian online education portal, MCQforall. What struck us was the relatively small, yet still significant, number of records exposed – 9,983 users. While the data types were limited to email addresses and password hashes, the nature of the platform, catering to individuals preparing for competitive exams, suggests a potentially motivated user base. The age of the breach, while not recent, warrants a review of our current user base for any overlaps with this compromised dataset.

The breach, discovered on a hacking forum, involved a database leak from MCQforall, an educational platform. This incident, which occurred prior to August 26, 2018, resulted in the exposure of 9,983 user records. The compromised data primarily consisted of email addresses and MD5 password hashes. The source structure points to a direct database exfiltration, likely a result of a SQL injection vulnerability or compromised database credentials. The threat theme here is the creation of potential credential stuffing lists, leveraging the email address and its associated, albeit weak, password hash for brute-force attacks against other services. Given the platform's focus on competitive exam preparation, the exposed user base could represent individuals actively seeking employment or career advancement, making them attractive targets for social engineering campaigns.

While this specific breach did not generate widespread news coverage at the time of its discovery, its inclusion in publicly available breach databases indicates its significance within the threat intelligence community. The use of MD5 hashes, a deprecated and easily crackable hashing algorithm, highlights a common security deficiency in older systems. The presence of this data on hacking forums suggests it has been available for some time, potentially being used in various malicious activities. Further OSINT investigations into the forum where it was leaked might reveal the initial vector of compromise or subsequent discussions about its exploitation, though the age of the data makes this less probable.