WORLDTECHYouHack forum breach data resurfaces online with 7.2 million credential pairs
Credentials from a 2013 breach of the YouHack cybercrime forum have reappeared online, as first reported by Tech Radar, with 7.2 million email address and password pairs in circulation. Researchers caution that the age of the incident does not render the material harmless.
Weak hashing eases recovery of passwords
Much of the password data was held as unsalted MD5 hashes, an approach regarded today as insecure, which contemporary hardware can reverse comparatively quickly.
Since many people reuse the same password on several services, the pairs remain useful to attackers for credential-stuffing and account takeover attempts.
Part of a wider recirculation pattern
The return of the YouHack records fits a wider trend in which older breach collections surface again, often packaged into larger compilations.
The same stretch has also brought a separate leak of 48 million Sberbank loyalty program records, which hacktivist groups have been linked to amid ongoing geopolitical tensions.
Experts stress password hygiene
Security specialists argue that the longevity of such data makes a case for stronger password management and for an end to reusing passwords across different online services.
Open questions
- How the 2013 YouHack data came to be published again remains unclear from the reporting?
- Whether accounts tied to the exposed pairs are still active is not stated?