UMJ Database Leaked: Every Record Has a Crackable MD5 Password

We noticed the emergence of a dataset on underground forums on February 13, 2022, containing information attributed to the Universitas Muhammadiyah Jakarta (UMJ) alumni portal. What struck us was the relatively contained scope, impacting 2,441 users, yet encompassing a range of personally identifiable information (PII) and authentication credentials. The presence of MD5 password hashes, while an older hashing algorithm, still presents a tangible risk for credential stuffing attacks and offline brute-forcing, especially given the potential for reuse of credentials across other platforms.

The breach, originating from UMJ's alumni portal database, exposed a total of 2,441 records. The compromised data fields include email addresses, first names, last names, phone numbers, and critically, MD5 password hashes. The source structure appears to be a direct dump of user account information, suggesting a potential vulnerability within the portal's database or its access controls. The leak locations were identified on several underground marketplaces, indicating a deliberate dissemination for potential exploitation.

While this specific breach did not garner significant mainstream media attention, it aligns with a broader trend of educational institutions becoming targets for data exfiltration. Research from various cybersecurity firms consistently highlights the higher education sector as a prime target due to its rich repositories of sensitive student and alumni data. The use of MD5, while outdated, remains a persistent concern in many legacy systems, making such breaches a recurring threat vector.

Our analysis indicates a compromise of the main database for the Universitas Muhammadiyah Jakarta (UMJ) alumni portal, discovered on February 13, 2022. This incident involved the exfiltration of 2,441 user records, a figure that, while not massive in absolute terms, represents a significant portion of the targeted alumni base. The exposed data includes a combination of PII and authentication credentials, specifically email addresses, full names, phone numbers, and notably, MD5 password hashes. The presence of MD5 hashes, a known weak hashing algorithm, is a significant concern, as it can be susceptible to rainbow table attacks and brute-force decryption, potentially leading to account takeovers if users have reused passwords.

The incident stemmed from a breach of the UMJ alumni portal's database, with the compromised data appearing on underground forums. The threat theme revolves around identity theft and credential compromise. The leak contained 2,441 records, comprising email addresses, first and last names, phone numbers, and MD5 password hashes. The source structure suggests a direct database dump, and the data was found disseminated across various underground marketplaces.

This specific incident has not been widely reported in major news outlets. However, it is consistent with a pattern of attacks targeting educational institutions for their sensitive data. Cybersecurity reports frequently cite universities and their alumni networks as attractive targets for threat actors seeking PII for fraudulent activities or for building comprehensive profiles for further attacks.

We observed the dissemination of a dataset linked to the Universitas Muhammadiyah Jakarta (UMJ) alumni portal on February 13, 2022. What is noteworthy is the specific nature of the compromised authentication data: MD5 password hashes. While the total number of affected users is relatively small at 2,441, the use of such an outdated hashing mechanism significantly elevates the risk of credential compromise. This type of data is highly valuable to attackers for offline cracking attempts and subsequent credential stuffing attacks against other services where users may have reused their UMJ credentials.

The breach originated from the UMJ alumni portal's database, leading to the exposure of 2,441 records. The data types include email addresses, first names, last names, phone numbers, and MD5 password hashes. The structure of the leaked data points to a direct database export. The leak was identified on underground forums, indicating a clear intent for exploitation by malicious actors.

There is limited public reporting on this specific breach. However, the compromise of educational institution databases is a persistent issue. Organizations like the Identity Theft Resource Center (ITRC) regularly track breaches, and educational institutions are consistently among the most frequently targeted sectors due to the sensitive nature of the data they hold.