Process Automation

We noticed a recent resurfacing of a dataset from August 2018, initially shared on a well-known hacking forum. This particular incident involved Process Automation, a Russian entity specializing in automation services. What struck us was the persistent availability of this older data, suggesting a lack of robust data lifecycle management or a failure to adequately address the initial compromise. The dataset, impacting 4,451 users, contained email addresses and password hashes, a combination that continues to pose significant risks in the current threat landscape.

The breach, discovered on August 26, 2018, stemmed from a database compromise. The leaked information comprised 4,451 records, each containing an email address and a password hash. The exact format of the password hashes was not specified in the initial reporting, but their presence alongside email addresses is a critical concern. This type of data is a prime candidate for credential stuffing attacks, where threat actors use the leaked credentials to attempt unauthorized access to other online services that users may have reused their credentials on. The source structure of the breach appears to be a direct database exfiltration, and the leak location was a prominent hacking forum, indicating a public dissemination of the compromised data.

While this breach occurred several years ago, its continued accessibility highlights a broader challenge in managing historical data exposures. There is no significant recent news coverage directly referencing this specific Process Automation leak, indicating it has largely faded from public discourse. However, the underlying threat of credential stuffing remains highly relevant. Research from various cybersecurity firms consistently points to credential stuffing as a primary attack vector for account takeovers. The OSINT surrounding this leak is limited to its initial appearance on hacking forums, underscoring the importance of proactive threat intelligence to identify and address such exposures before they can be widely exploited.

We observed a significant data leak originating from MyHeritage, a popular online genealogy service, which became public knowledge in June 2017. The discovery was made when a threat actor offered a substantial database for sale on the dark web. What is particularly concerning is the sheer volume of records exposed and the sensitive nature of the data, which includes not only login credentials but also potentially personal information linked to genealogical research. This incident underscores the persistent risks associated with large-scale consumer data platforms and the critical need for stringent data protection measures.

The MyHeritage breach, initially reported in June 2017, involved a massive dataset of approximately 92 million user records. The compromised data primarily consisted of email addresses and hashed passwords. While the exact hashing algorithm used was not immediately disclosed, the exposure of such a large number of credentials presents a substantial risk. This breach is categorized as a database compromise, with the data likely exfiltrated directly from MyHeritage's backend systems. The leak location was initially identified as a dark web marketplace, indicating a commercial intent behind the data dissemination. The implications are far-reaching, as these credentials could be used for account takeovers on MyHeritage itself or, more alarmingly, for credential stuffing attacks against other online services where users may have reused their credentials.

This MyHeritage breach garnered considerable media attention at the time of its discovery. Numerous cybersecurity news outlets reported on the incident, highlighting the scale of the compromise and the potential impact on users. External research from cybersecurity firms has since analyzed the implications of such large-scale credential leaks, emphasizing the ongoing threat of credential stuffing and the importance of multi-factor authentication. OSINT investigations at the time confirmed the availability of the data on dark web forums, corroborating the initial reports. The incident has served as a case study for data security best practices for consumer-facing platforms handling sensitive personal information.

Our analysis has identified a concerning data exposure linked to Canva, the widely used online design platform, with the leak surfacing around July 2019. We noticed that a substantial collection of user data, including sensitive personal identifiers, was made available through unauthorized channels. What struck us as particularly alarming is the inclusion of personally identifiable information beyond just login credentials, suggesting a deeper level of system compromise. This incident serves as a stark reminder of the vulnerabilities inherent in platforms that aggregate and store extensive user profiles.

The Canva breach, which came to light in July 2019, involved the compromise of an estimated 139 million user records. The leaked data included a variety of information types, most notably email addresses, names, and importantly, usernames and links to user-uploaded images. This last data type is especially concerning, as it could potentially expose proprietary or private visual content created by Canva users. The breach is classified as a database compromise, with the data likely exfiltrated from Canva's primary user database. The leak location was reported to be a private data dump, suggesting a targeted rather than a broad public release, though its eventual dissemination is still a significant risk. The combination of login credentials and links to personal image content presents a multifaceted threat, including account takeover and potential exposure of sensitive visual assets.

The Canva breach was widely reported by major technology and cybersecurity news outlets in July 2019, underscoring the significant impact on a platform with a massive user base. Investigations at the time confirmed the authenticity of the leaked data and its availability through various illicit channels. While the immediate aftermath focused on the immediate risks to users, subsequent OSINT and research have highlighted the evolving tactics of data exfiltration, particularly concerning the targeting of creative platforms. The incident has prompted discussions within the cybersecurity community regarding the security of cloud-based design tools and the protection of user-generated content.