VacationZone

We noticed an unusual spike in credential stuffing attempts originating from a specific IP block targeting several of our high-value user accounts. This pattern led us to investigate further, and what struck us was the sheer volume of compromised credentials associated with a single, seemingly unrelated entity. The discovery of a significant data dump on a public cybercrime forum, directly linked to this entity, confirmed our suspicions of a widespread compromise. The implications of this breach extend beyond mere credential exposure, raising concerns about the potential for further downstream attacks leveraging this readily available information.

The breach, affecting the Thailand-based travel agency VacationZone, was discovered on August 24, 2018, when a substantial dataset was found circulating on a prominent cybercrime forum. The compromised database contained 24,990 unique email addresses and their corresponding plaintext passwords. This represents a significant exposure of user credentials, making it a prime target for credential stuffing and account takeover attacks. The nature of the leaked data, particularly the plaintext storage of passwords, indicates a critical security misconfiguration within VacationZone's infrastructure. The breach type is categorized as a database compromise, likely exacerbated by the creation of a combolist from the exposed data, increasing its utility for malicious actors.

While this specific VacationZone breach did not generate widespread mainstream news coverage at the time of its discovery, it aligns with a broader trend of travel and hospitality sector vulnerabilities. Research from various cybersecurity firms in the years following 2018 consistently highlighted the attractiveness of travel-related data for cybercriminals due to its potential for identity theft and fraudulent bookings. The availability of plaintext passwords on public forums, as seen in this instance, is a recurring theme in OSINT investigations into compromised credentials, underscoring the persistent challenges in secure password management across various industries.