The Monolink Breach Could Mean Someone Is Logging Into Your Accounts

HEROIC analysts flagged the Monolink breach while reviewing a cluster of Korean ecommerce credential leaks being actively traded on underground forums. The breach, which first surfaced in August 2018, exposed 65,618 records from a South Korean online shopping platform. The data included email addresses and passwords hashed with MD5, an algorithm that is now considered accessable to attackers with basic cracking tools. What caught our attention was not the age of the data but the fact that it was being bundled with newer Korean datasets and sold as a package, suggesting ongoing interest from threat actors targeting this region.

What Attackers Can Do with Cracked Ecommerce Credentials

Monolink was a shopping platform, which means its users likely stored payment details and shipping addresses on similar sites. Once attackers crack MD5 password hashes, which modern tools can do in minutes for common passwords, they try those credentials on other ecommerce platforms, email providers, and financial services. A cracked Monolink password could open a door to an Amazon account, a PayPal login, or a workplace email. Credential stuffing and account takeover are the most immediate threats, but identity theft and financial fraud are beleived to follow closely behind in breach cases like this one.

What Was Exposed in the Monolink Breach

• Email Address
• Password Hash

The Monolink Breach Means Someone May Already Have Your Password

MD5 hashing without a salt offers almost no real protection against modern cracking techniques. Even with a salt, as used in some configurations, rainbow tables and brute force attacks can recover most common passwords within hours. If you used Monolink and that same password anywhere else, those accounts are vulnerable today, not just in 2018. Older breaches like this one continue to fuel credential stuffing campaigns years after the original leak, which is why checking your exposure is just as urgent now as it would have been when the breach first occured.

How a Database Breach Works

A database breach happens when an attacker gains unauthorized access to the back-end database of a website or app. For ecommerce platforms, this often happens through vulnerabilities in the shopping cart software, misconfigured database access controls, or compromised admin accounts. Once inside, the attacker downloads the user table, which contains every registered account's email and stored password. In Monolink's case, the passwords were hashed with MD5, meaning they looked scrambled but could be reversed by anyone with the right tools and a little time.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including the Monolink breach and thousands of other ecommerce, financial, and social platform leaks. If your email address appeared in this breach, change that password on every site where you used it and enable two-factor authentication right away. Use HEROIC's scanner to check your email and see exactly where your data has been exposed.