PromSnab123

We've been tracking a resurgence of older breaches appearing in combolists, often targeting users who reuse credentials across multiple platforms. What caught our attention with the PromSnab123 breach wasn't the size – just over 17,000 records – but the age and the fact that passwords were stored in plaintext. This suggests a significantly outdated security posture and a potential goldmine for attackers looking to pivot into other, more valuable accounts. The lack of basic security measures makes this more than just a historical curiosity; it's a live risk.

PromSnab123: A Blast from the Past with Present-Day Risks

A dataset from PromSnab123, a Russian industrial classifieds board, surfaced on a hacking forum in August 2018. The breach impacted 17,124 users, exposing their email addresses and, critically, their passwords stored in plaintext. The site itself, used for advertising and selling industrial equipment, is now defunct, but the leaked credentials continue to circulate.

The breach came to light when the dataset was posted on a well-known hacking forum, indexed by several breach notification services. While the initial appearance dates back to August 2018, we observed a renewed interest in the data in recent weeks, with multiple combolists incorporating the PromSnab123 credentials. The lack of password hashing immediately raised a red flag. This is not a sophisticated attack; it's a failure of basic security practices that continues to pose a risk years later. The risk for enterprises is that employees may have used corporate email addresses when registering on the site, or reused the same password on other, more critical accounts.

• Total records exposed: 17,124
• Types of data included: Email addresses, plaintext passwords
• Sensitive content types: Potentially corporate email addresses
• Source structure: Combolist
• Leak location(s): Hacking forums, combolists
• Date of first appearance: August 2018

Troy Hunt of HaveIBeenPwned added the PromSnab123 breach to his database in 2018, noting the plaintext passwords. This aligns with our findings regarding the severity of the breach. The continued circulation of this data underscores the importance of monitoring employee credentials across multiple platforms.