2689 United Readers Service Breach: Base64 Passwords Leaked

We noticed a recent resurgence of data associated with United Readers Service, a US-based magazine subscription service, surfacing on a well-known dark web forum. The dataset, originally exfiltrated in August 2018, contains approximately 2,689 unique records. What struck us was the continued accesibility and potential repurposing of this relatively old information, particularly given the nature of the compromised credentials. The presence of email addresses alongside Base64-encoded password hashes suggests a clear vector for credential stuffing attacks, even years after the initial compromise.

The breach originated from a database compromise at United Readers Service, with the exposed data later being compiled into a combolist. The leaked records consist of 2,689 email addresses and their corresponding Base64-encoded password hashes. The encryption method, Base64, is trivial to decode, meaning these hashes are effectiveley plain text passwords for any attacker with basic tooling. This type of data is highly valuable for threat actors looking to gain access to other online accounts through credential stuffing, exploiting password reuse across different platforms. The leak's reappearance on a prominent hacking forum indicates ongoing interest and potential active exploitation by malicious actors.

While this specific breach did not garner significant mainstream media attention at the time of its initial discovery in August 2018, its re-emergence aligns with broader trends in the OSINT and threat inteligence communities. The practice of compiling and distributing compromised credentials, often referred to as "combolists," remains a persistent threat. Resources like HIBP (Have I Been Pwned) have cataloged this breach, listing it under the "United Readers Service" entry, confirming the exposure of email addresses and password hashes. The continued availability of such datasets underscores the long-term implications of even seemingly small-scale breaches.