Tekla Structures

We noticed a recent resurgence of interest in a data exposure incident originally documented in August 2018. The incident involved a regional community and resource website, Tekla Structures, which served users of Tekla Structures software in Iran. What struck us was the longevity of this particular dataset's availability and its reappearance in discussions on various underground forums. The breach, affecting 3,174 individuals, primarily comprised email addresses and password hashes, a common but still significant threat vector when re-used across platforms.

The initial discovery of this breach occurred in August 2018, when a dump of user credentials from the Tekla Structures website was shared on a prominent hacking forum. The dataset, containing 3,174 records, included user email addresses and associated password hashes. Notably, the hashing algorithms employed were a mix of MD5 and phpass, the latter being a common WordPress hashing method. This suggests a potential for credential stuffing attacks if users have reused their passwords across different services, especially those that may still be vulnerable to MD5 cracking or utilize similar hashing mechanisms. The source structure appears to be a direct database export, indicating a compromise of the website's backend infrastructure.

While this specific incident did not garner widespread mainstream media attention at the time of its initial disclosure, its continued circulation on dark web marketplaces and hacking forums points to its utility for threat actors. The presence of email addresses and password hashes makes it a prime candidate for inclusion in credential stuffing lists. OSINT investigations into similar data dumps from regional forums often reveal patterns of attackers targeting specific user bases for further exploitation, such as phishing campaigns or attempts to gain access to associated professional accounts. The fact that the website is now defunct does not diminish the risk; rather, it highlights the persistent threat of legacy data being weaponized.