Organic Food Markets: 6,033 Real Logins Are Now Compromised

We noticed the reappearance of a dataset on a well-known underground forum, originally surfacing in August 2018. This particular dump, attributed to Organic Food Markets, an Australian entity facilitating weekly outdoor markets in Sydney, has resurfaced, impacting a recorded 6,033 user accounts. What struck us was the continued availability of these credentials, despite the initial disclosure over three years ago, suggesting a lack of proactive credential management or re-authentication efforts by the affected user base.

The breach, initially discovered on August 26, 2018, involved the exfiltration of email addresses and phpass password hashes. The source structure indicates a direct database compromise, allowing threat actors to extract user account information. The significance of this leak lies not only in the exposed contact details but also in the password hashes, which, while not plaintext, are susceptible to brute-force attacks and credential stuffing if weak hashing algorithms or salts were employed. The continued presence of this data on public forums highlights the persistent risk of credential reuse and the long-term implications of even seemingly "old" breaches.

External Context

While this specific breach of Organic Food Markets did not garner significant mainstream news coverage at the time of its initial discovery, it aligns with a broader trend of retail and food service organizations becoming targets. Research from cybersecurity firms consistently points to the retail sector as a high-value target for data theft due to the volume of customer data collected. The use of phpass, while an older hashing method, was not uncommon in many web applications of that era, and its vulnerabilities have been well-documented, making such hashes a prime target for offline cracking attempts.