VNG

We've been tracking the resurgence of older database dumps appearing on Telegram channels, often repackaged as "new" leaks to lure in buyers. What really struck us about the recent posting of the VNG data wasn't the volume – over 25 million records – but the age of the data and its continued relevance to password reuse and account takeover attempts. The breach, originating in May 2015, highlights the long tail of risk associated with legacy data breaches and the enduring value of seemingly outdated credentials.

The VNG Breach: A Legacy of Exposed Data

The VNG breach, impacting the Vietnamese company, surfaced on a popular hacking forum in April 2018, though the actual breach occurred three years prior. The data was subsequently traded and redistributed across various platforms, including Telegram channels we monitor. What caught our attention was the breadth of personal information exposed, including usernames, birth dates, genders, home addresses, and notably, 25 million unique email addresses. The use of unsalted MD5 hashes for passwords further exacerbates the risk, making brute-force attacks relatively straightforward even today. This incident underscores the persistent threat posed by older breaches, especially when combined with weak or outdated security practices.

The VNG breach matters to enterprises because it exemplifies the cascading risk of password reuse. Users who employed the same credentials on VNG services may have also used them on other platforms, including corporate accounts. The availability of this data allows attackers to conduct credential stuffing attacks, attempting to log in to various services using the compromised email addresses and passwords. The age of the breach does not diminish its potential impact; in fact, it may increase the likelihood of successful attacks, as users may have forgotten about the compromised accounts or failed to update their passwords on other platforms.

Breach Stats

• Total records exposed: 25,080,873
• Types of data included: Email Address, First Name, Last Name, Username, Phone Number, Password Hash, IP Address, Birthday
• Sensitive content types: PII
• Source structure: Database
• Leak location(s): Hacking forums, Telegram channels
• Date of first appearance: May 19, 2015 (breach date), April 2018 (public disclosure)

External Context & Supporting Evidence

While specific news coverage of the initial VNG breach is limited in English-language media, the incident is documented on breach notification sites and within the security community. DataViper, a data breach monitoring service, included VNG in their list of breaches. The use of MD5 hashing without salting was criticized in numerous security blogs and forums at the time of the breach's disclosure, highlighting the company's insufficient security measures. The re-emergence of this data on Telegram channels echoes a broader trend: older breaches being recycled for profit by malicious actors, as reported by several cybersecurity firms. One Telegram post claimed the files were "freshly cracked," despite the breach being several years old, demonstrating the deceptive tactics used to market compromised data.