TooEasy

We noticed a significant influx of compromised credentials originating from a French IT services platform, TooEasy, appearing on a prominent cybercrime forum on February 10th, 2024. What struck us was the sheer volume of personally identifiable information (PII) alongside the credential data, suggesting a broad impact beyond mere account takeovers. The exposed dataset, comprising over 835,000 records, includes not only email addresses and names but also physical addresses and business affiliations, painting a detailed picture of the affected individuals and entities. The presence of SHA1 hashed passwords, while not ideal, still presents a tangible risk of offline brute-force attacks given sufficient computational resources.

The breach, identified through routine monitoring of dark web marketplaces and forums, appears to stem from a direct database compromise of the TooEasy platform. The leaked data, totaling 835,897 lines, contains a substantial number of unique entries: 75,578 email addresses, first and last names, phone numbers, and physical addresses. Notably, business names were also exfiltrated, indicating a potential targeting of professional contacts or client lists. The credential data consists of SHA1 hashed passwords, a legacy hashing algorithm that, while computationally intensive to crack, is not considered cryptographically secure against modern brute-forcing techniques. The data was subsequently disseminated on a well-known cybercrime forum, increasing its accessibility to malicious actors.

While this specific incident has not yet garnered widespread media attention, similar breaches involving French IT service providers have been reported in the past, often linked to supply chain attacks or direct exploitation of vulnerabilities within their infrastructure. Open-source intelligence (OSINT) searches reveal TooEasy's role in providing IT solutions to various businesses, making the exposure of their client data a significant concern for downstream entities. Research into the effectiveness of SHA1 hashing against modern cracking tools consistently highlights its weaknesses, with specialized hardware capable of cracking SHA1 hashes within hours or days, depending on complexity.