YU-MIDI

We noticed a recent resurfacing of data originating from YU-MIDI, a Bosnian online forum that ceased operations several years ago. The initial breach occurred in August 2018, and the dataset has since been circulating on various underground marketplaces. What struck us about this particular leak is its enduring presence and the potential for credential stuffing attacks even against a defunct platform, given the common practice of password reuse.

The YU-MIDI breach, discovered in August 2018, compromised approximately 17,198 unique user records. The exposed data consists of email addresses and MD5 hashed passwords. This type of legacy data, even from a defunct site, remains a significant risk. Attackers can leverage these credentials for credential stuffing attacks against other, currently active online services, exploiting users who have reused their YU-MIDI passwords. The source structure was a database dump, and the leak locations have historically been prominent hacking forums and marketplaces.

While YU-MIDI itself is no longer active, the implications of such older breaches are frequently highlighted in cybersecurity research. For instance, reports from organizations like HIBP (Have I Been Pwned) consistently demonstrate the long tail of credential reuse and the persistent threat posed by historical data dumps. The prevalence of MD5 hashing, a now considered weak cryptographic function, further exacerbates the risk, making password cracking more feasible for threat actors.