Not Just Church Suits

We noticed a concerning dataset surfacing on a well-trafficked hacking forum, dated August 21, 2018. This particular leak, originating from a U.S.-based retail entity, Not Just Church Suits, involved a relatively modest but still significant number of user records. What struck us was the straightforward nature of the exposed credentials, primarily email addresses and their associated password hashes. While the volume might not be enterprise-shattering, the implications for credential stuffing and further targeted attacks remain a persistent threat, especially given the typical user behavior of password reuse.

The breach breakdown reveals that 5,157 user records were exfiltrated and subsequently published. The compromised data primarily consists of email addresses and MD5 password hashes. This indicates a direct database compromise or a leak from a system where user credentials were stored. The use of MD5, a notoriously weak hashing algorithm, is a critical vulnerability in itself, as these hashes are highly susceptible to brute-force attacks and rainbow table lookups. The threat theme here is clear: compromised credentials, easily crackable, can serve as a gateway to other accounts if users have reused their passwords across different platforms. The source structure suggests a direct dump of user account information, likely from a customer database.

At the time of the leak in August 2018, there was no significant widespread news coverage or OSINT chatter specifically about the Not Just Church Suits breach. However, the general trend of retail data breaches, particularly those exposing customer credentials, was a well-documented and ongoing concern within the cybersecurity community. Research from various security firms during that period consistently highlighted the risks associated with weak password hashing and the pervasive threat of credential stuffing attacks enabled by such leaks.