Military & Outdoor

We noticed a recent resurfacing of credentials originating from a 2018 incident involving the Hungarian e-commerce site, Military & Outdoor. While the breach itself is not new, its inclusion in a recently circulating combolist on underground forums warrants attention. What struck us was the persistence of these older credentials in active threat actor toolkits, suggesting a continued reliance on legacy data for credential stuffing operations against less security-conscious users. The relatively small scale of the original breach (10,308 records) might lead some to overlook its current relevance, but the nature of the leaked data – email addresses and password hashes – makes it a potent ingredient for broader account compromise campaigns.

The original compromise of Military & Outdoor, a site catering to military and camping enthusiasts, occurred prior to August 26, 2018. A dataset containing 10,308 user records was subsequently leaked on a hacking forum. The compromised information comprised email addresses and password hashes, with the specific hashing algorithm remaining undisclosed. This breach, categorized as a database compromise subsequently leveraged in combolists, exposed user credentials that have likely been reused across multiple online services. The threat theme here is the enduring risk posed by credential stuffing, where attackers systematically attempt to log into various platforms using compromised username/password pairs obtained from disparate breaches.

While this specific breach did not garner significant mainstream news coverage at the time of its initial discovery, its inclusion in recent combolist aggregations aligns with broader trends in cybercrime. OSINT investigations into similar combolists often reveal a patchwork of data from numerous smaller breaches, meticulously curated by threat actors for maximum efficacy. Research from cybersecurity firms consistently highlights credential stuffing as a primary vector for account takeover, underscoring the long-term value of even seemingly minor data leaks to malicious actors.