14 DAY TRIAL // Abu Nazir, a hacker from Poland, leaked around 250,000 credential sets from the servers of Gram24.pl, a popular forum, and Vista.pl a site that offers news, scripts, software and other useful things.
The hacker’s Pastebin account reveals that 236,351 usernames, MD5 password hashes, their salt, and email addresses were stolen from the databases of Gram24 and 12,740 were taken from Vista. In the latter’s case there is no salt column, which may indicate that the site’s administrators encrypted the passwords without using salt.
The hacker told us that he didn’t hack many websites before these two, but decided to turn his attention to sites from Poland for a while.
He claims that he leveraged some SQL injection flaws and some “server security weaknesses” to gain unauthorized access to the sites’ databases.
Abu Nazir didn’t provide any reasons for hacking the sites, but he said that their administrators were warned before that massive data quantity was made available.
“I find the gap, and leave a message to the admin. If admin does not secure the server in a few days, I publish a base,” the hacker said.
At the time of writing both websites are functioning properly, but their administrators haven’t posted any messages to let their customers know that their credentials were made public.
Internet users who own accounts on Gram24.pl and Vista.pl are advised to change their passwords as a form of precaution.
Since 250,000 email addresses can be highly useful for cybercriminals who want to launch massive targeted spam campaigns, the chances are fairly high that malicious notifications may land in the account holders' inboxes these days.
This is why they’re recommended to be on the lookout for any unsolicited emails that request private information. Also, they should beware of phishing campaigns that might rely on the incidents.