PMNetwire

We noticed a recent resurgence of interest in a dataset originating from PMNetwire, a U.S.-based free news service that ceased operations years ago. This particular breach, dating back to August 26, 2018, has resurfaced on a prominent hacking forum, indicating potential reuse or re-analysis by threat actors. What struck us was the presence of plaintext passwords alongside email addresses, a configuration that significantly lowers the barrier to unauthorized access for any subsequent credential stuffing attempts. The relatively small pwned count of 13,818 users does not diminish the inherent risk, especially considering the data's age and the potential for credential reuse across other services.

The PMNetwire breach, discovered in August 2018, involved a database compromise that exposed the credentials of 13,818 users. The leaked data primarily consists of email addresses and their associated plaintext passwords. This type of exposure is particularly concerning as it directly facilitates credential stuffing attacks. Threat actors can leverage these email/password pairs against other online services, exploiting the common practice of password reuse among users. The source structure of the leak suggests a direct database dump, making the extraction and parsing of sensitive information straightforward. The leak locations are primarily within dark web forums and marketplaces where such compromised datasets are frequently traded and utilized.

While this specific breach is not widely covered in mainstream news, its characteristics align with a common threat theme: the exploitation of older, less secure datasets for modern attack campaigns. Research from various cybersecurity firms consistently highlights the persistent danger posed by credential stuffing, where breached password lists are systematically tested against popular websites and services. The fact that this dataset is being actively discussed or re-shared on hacking forums suggests it may be incorporated into larger, more sophisticated attack infrastructures or used by emerging threat actors who may not have been active during the initial breach period.