Vpliuse (Вплюсе)

We noticed a significant influx of credential stuffing attempts originating from a newly surfaced dataset attributed to the Russian sports betting platform, Vpliuse (Вплюсе). The discovery, made on 23-Oct-2025, revealed a substantial volume of user credentials being actively exploited across various online services. What struck us immediately was the inclusion of both plaintext and hashed passwords, indicating a concerning lack of consistent security practices within the compromised database. This dual exposure significantly amplifies the risk of account compromise for affected users, extending beyond the immediate platform.

The breach, identified on 23-Oct-2025, exposed approximately 106,835 user records from Vpliuse, a Russian sports betting platform. The compromised data encompassed a mix of sensitive information, including email addresses, usernames, and critically, password hashes (MD5 and bcrypt) alongside a number of plaintext passwords. The source structure of the leak points to a direct database exfiltration. These records subsequently appeared on a Telegram channel, a common vector for the distribution of compromised credentials. The presence of plaintext passwords is a particularly alarming threat theme, as it bypasses any hashing mechanism and allows for immediate use by malicious actors. The sheer volume of exposed credentials, coupled with the varying levels of password security, presents a high probability of successful credential stuffing attacks against Vpliuse users, and potentially against other services where these credentials may be reused.

While specific news coverage directly detailing the Vpliuse breach at its discovery date is limited, the methodology of data distribution via Telegram channels is a well-documented trend in OSINT. Research into past breaches involving similar Russian platforms often highlights the prevalence of MD5 hashing, a known weak hashing algorithm, alongside more robust options like bcrypt, suggesting a potential legacy issue or inconsistent implementation of security controls. The active exploitation of such datasets on the dark web is a recurring theme, with threat intelligence reports frequently detailing campaigns leveraging these leaked credentials for further malicious activities, including account takeover and phishing.