Randozone

We noticed a recent resurfacing of credentials originating from a 2018 incident involving Randozone, a French online resource catering to hiking and trekking enthusiasts. The initial discovery of this dataset on a prominent hacking forum in August 2018 indicated a compromise of user account information. What struck us was the persistent availability of these credentials, suggesting that threat actors may still be leveraging this older breach for credential stuffing attacks against other platforms.

The Randozone breach, which occurred on or before August 21, 2018, exposed the account details of 4,942 users. The compromised data primarily consisted of email addresses and corresponding SHA-1 password hashes. This type of breach, often categorized as a database compromise, makes the exposed information a prime candidate for inclusion in credential stuffing lists. The use of SHA-1, while considered weak by modern cryptographic standards, still presents a risk, especially when paired with commonly reused passwords. The source structure of the leak points to a direct database exfiltration, rather than a more complex supply chain attack.

While this specific Randozone breach did not garner significant mainstream media attention at the time of its initial discovery, it aligns with a broader trend of smaller, niche websites being targeted for their user data. OSINT analysis of similar incidents reveals that credential dumps from such platforms are frequently repurposed for widespread attacks. Research from cybersecurity firms consistently highlights the ongoing threat posed by credential stuffing, where attackers use lists of compromised usernames and passwords to attempt unauthorized access to other online services. The longevity of such leaks in underground forums underscores the need for continuous monitoring of compromised credential databases.