SkTorrent

We've been tracking the resurgence of older breaches in recent months, often resurfacing on Telegram channels and dark web forums after years of dormancy. What really struck us with the **SkTorrent** breach wasn't just the plain text passwords, a sadly common practice in 2016, but the way the data was being actively repackaged and offered as a "starter pack" for credential stuffing attacks targeting Slovakian online services. The breach itself is old news, but its current exploitation highlights the long tail of data breaches and the ongoing risk posed by poorly secured legacy systems.

SkTorrent's Plain Text Password Problem Resurfaces

The **SkTorrent** breach, dating back to **February 2016**, involved the compromise of a database from the Slovak torrent tracking site. While the torrent site itself is relatively obscure, the exposed data has become a relevant threat vector again after being repackaged for credential stuffing attacks. It was discovered by our team while monitoring a Telegram channel known for aggregating and selling breached databases.

The re-emergence of this breach is noteworthy because it demonstrates how older breaches can be weaponized years later. The ease with which attackers can obtain and repurpose this data underscores the need for continuous monitoring of leaked credentials and proactive password resets, especially for users who may have used the same credentials across multiple sites.

• Total records exposed: **117,000**
• Types of data included: **Email Address, Username, Passwords (plain text)**
• Source structure: **Database**
• Leak location(s): **Telegram channels, dark web forums**
• Date leaked: **29-Feb-2016**

External Context & Supporting Evidence

While mainstream media coverage of the original SkTorrent breach is limited, the incident is documented in breach notification databases like Have I Been Pwned? (HIBP entry). This allows us to verify the details of the breach and its impact on individual users.

The repackaging of the SkTorrent data aligns with a broader trend of threat actors leveraging older breaches for credential stuffing. Security researchers have observed a surge in activity on Telegram channels dedicated to trading and sharing breached databases, often with a focus on specific geographic regions or industries. One Telegram post claimed the files were "Slovak credentials pack 2016 - good for banking attempts".