MyDayBoat

We noticed a significant data leak surfacing on a well-known dark web forum on October 3rd, 2018. This incident involved MyDayBoat, a platform facilitating direct boat rentals and charters. What struck us was the dual nature of the password hashing, indicating a potential lack of robust security practices or a legacy system still in place. The exposure of 3,881 user records, comprising email addresses and their associated password hashes, presents a clear risk for credential stuffing attacks and further compromise of users' online identities.

The breach breakdown reveals a database compromise affecting 3,881 MyDayBoat users. The leaked data includes email addresses and password hashes. Notably, the password hashes were stored in two formats: the older MySQL hash and MD5. This dual storage suggests either a phased migration or a deliberate, albeit insecure, approach to password management. The source of the compromise appears to be a direct database extraction. The leak locations were identified as a prominent hacking forum, indicating an intent to monetize or distribute the compromised credentials. The threat themes here are primarily account takeover and identity theft, amplified by the availability of both email addresses and hashed passwords, which can be cracked or used in conjunction with other leaked credentials.

While there was no widespread news coverage at the time of the leak, a review of OSINT indicates MyDayBoat operated primarily within the European market, with servers hosted in Serbia. The nature of the data and the platform's niche market suggest that the primary threat actors would be those interested in targeting recreational boat owners and renters, or those looking to exploit credentials for broader financial gain. Further research into similar platform breaches from that period might reveal common attack vectors or actor groups that could have been involved.