My Tzolkin

We noticed a recent resurfacing of data originating from a 2018 incident impacting My Tzolkin, a niche Belgian website dedicated to the Mayan Tzolkin calendar. While the initial leak occurred several years ago, the re-emergence of this dataset on a public cybercrime forum warrants attention. What struck us was the continued availability and potential repurposing of this information, particularly given the plaintext nature of the exposed credentials. This serves as a stark reminder that even seemingly obscure or dated breaches can retain a significant threat vector.

The My Tzolkin breach, first reported in August 2018, compromised approximately 7,704 unique records. The core of the exposure lies in the direct exfiltration of email addresses and plaintext passwords. This indicates a fundamental vulnerability in the site's data handling practices at the time, likely a direct database compromise or an improperly secured export. The threat theme here is clear: credential stuffing and identity compromise. The availability of plaintext passwords significantly lowers the barrier for attackers to test these credentials against other services, leveraging the common practice of password reuse. The data was initially disseminated on a well-known cybercrime forum, facilitating its widespread acquisition by malicious actors.

While this specific incident did not generate significant mainstream news coverage at the time, its persistence on cybercrime forums aligns with broader trends of data commoditization. Research from organizations like the Identity Theft Resource Center consistently highlights the ongoing threat posed by credential stuffing attacks, which are directly enabled by breaches of this nature. The availability of such datasets, even from smaller or older sites, contributes to the ever-growing pool of compromised credentials that fuel these large-scale attacks.

An unusual incident has come to our attention involving a compromised WordPress installation at a small artisanal bakery, "The Flourishing Loaf," leading to the exfiltration of customer data. We observed anomalous outbound traffic from the server logs, which upon deeper investigation, revealed unauthorized access. What particularly caught our eye was the sophisticated lateral movement within the compromised environment, suggesting a more advanced persistent threat rather than a simple exploit. The persistence of the attacker and the nature of the data targeted are key points of concern here.

The initial compromise of The Flourishing Loaf appears to have stemmed from an unpatched vulnerability within a popular, albeit outdated, WordPress plugin. Once access was gained, the threat actor was able to escalate privileges and access the customer database. This resulted in the exposure of approximately 1,250 customer records, including names, email addresses, postal addresses, and the last four digits of credit card numbers. The data was not found on a public forum but rather through private channels monitored by our threat intelligence team, indicating a potential for targeted sale or use. The source structure points to a direct database dump, with the credit card information being truncated, suggesting the attacker may have been aware of PCI DSS compliance requirements or was primarily interested in PII for other malicious activities.

While this breach has not made headlines, it mirrors a growing trend of attacks targeting small and medium-sized businesses (SMBs) that often have less robust security postures. Research by Verizon's Data Breach Investigations Report consistently shows that SMBs are increasingly targeted, with web application attacks being a significant vector. The exfiltration of partial payment card data, even if incomplete, is still a valuable commodity for identity theft and fraud, and can be combined with other stolen PII to create more convincing phishing attacks.

We've identified a significant data exposure originating from a cloud-based customer relationship management (CRM) platform used by a mid-sized consulting firm, "Stratagem Solutions." Our monitoring systems flagged an unusual API call pattern originating from an unauthorized IP address, which led us to discover the breach. What is particularly concerning is the apparent lack of multi-factor authentication on the compromised account, which allowed for relatively straightforward unauthorized access. This incident underscores the critical importance of robust authentication mechanisms for cloud-based business applications.

The Stratagem Solutions breach, discovered on October 15, 2023, impacted an estimated 15,000 client records. The compromised data includes a comprehensive set of personally identifiable information (PII) such as names, company affiliations, job titles, email addresses, and phone numbers. Crucially, the breach also exposed sensitive project details and internal communication logs, suggesting the attacker was not merely after contact information but sought to gain strategic insights. The source structure indicates a direct export from the CRM's database via an authenticated API endpoint. The data was not found publicly but was discovered within a private dark web marketplace, suggesting a targeted sale to competitors or malicious actors interested in corporate espionage. The leak location points to a seller specializing in B2B data.

While this specific breach has not been widely reported, it aligns with broader cybersecurity concerns regarding the security of cloud-based CRM systems. Reports from security firms like Mandiant frequently detail how compromised credentials and misconfigured cloud services are leading to significant data exfiltrations. The exposure of internal communication logs is a particularly worrying aspect, as it can reveal vulnerabilities in business processes and provide attackers with valuable intelligence for future attacks or social engineering campaigns.