Short Fiction

We've been tracking an uptick in older database breaches resurfacing in various dark web marketplaces, often repackaged and sold as "new" intelligence. What really caught our attention with this particular dump wasn't its size, but the surprisingly high percentage of still-valid credentials. The data had been circulating quietly for years, but we noticed a recent spike in mentions across several threat actor forums, suggesting a renewed interest in these older datasets. The potential for password reuse across platforms makes this breach, despite its age, a relevant risk for enterprises today.

The Short Fiction Breach: Almost 10,000 Accounts Exposed

The breach of Short Fiction, a website dedicated to short stories, resulted in the exposure of 9,545 user accounts. This leak, which occurred on March 31, 2016, included a combination of sensitive data that could be leveraged for credential stuffing attacks. While the breach itself is not new, its re-emergence highlights the persistent threat posed by older, forgotten breaches.

Our team discovered this breach while monitoring a well-known database trading Telegram channel. What made it stand out was the claim that a significant portion of the exposed passwords were still active. We quickly confirmed the presence of email addresses, usernames, and passwords. The passwords were stored as hashes, but the age of the breach suggests that many of these hashes have likely been cracked over time using rainbow tables or other brute-force techniques.

This breach matters to enterprises because it underscores the ongoing risk of credential reuse. Users often employ the same email address and password combinations across multiple platforms. This means that a breach from a relatively obscure website like Short Fiction can potentially compromise accounts on more critical business applications. Given the age of the breach, it is unlikely that users have updated their passwords on other platforms since the original exposure, increasing the likelihood of successful attacks.

• Total records exposed: 9,545
• Types of data included: Email Addresses, Usernames, Passwords (hashed)
• Source structure: Database dump
• Leak location(s): Telegram channels, various breach forums.
• Date of first appearance: March 31, 2016

External Context & Supporting Evidence

While the Short Fiction breach itself didn't garner major media attention, similar breaches of smaller online communities have been reported by outlets like BleepingComputer and The Record, highlighting the frequency of these incidents. The re-emergence of this data aligns with a broader trend observed in cybercrime communities: threat actors are increasingly leveraging older breach datasets for credential stuffing attacks and account takeover attempts.

On several dark web forums, users have discussed the utility of "old but gold" data dumps, emphasizing the potential for password reuse. One forum post claimed that datasets from the 2010s are particularly valuable because users are less likely to have updated their passwords since then. While we cannot independently verify this claim, it reflects the prevailing sentiment within these communities.