The North Face
April 23, 2025
•[ hack, brute-force, retail ]
Attackers used previously leaked credentials in a large-scale credential-stuffing campaign against The North Faces online customer accounts in April 2025. Unauthorized logins exposed personally identifiable information from 2,861 customer profiles, though no financial data was accessed.
Greenbaum, Rowe, Smith & Davis LLP
November 25, 2025
•[ hack, brute-force, healthcare ]
An unauthorized party used compromised login credentials to access Greenbaum, Rowe, Smith & Davis LLP's network server between November 25 and November 27, 2025. The firm discovered the intrusion on November 27 and determined on April 15, 2026 that files containing patient information from healthcare clients had been acquired. Greenbaum reset passwords, replaced compromised equipment, notified law enforcement, and offered identity-monitoring services. No operational disruption was reported, no group claimed the attack, and no stolen data was found published or misused. Criminal and Financial are bounded inferences from credential-based theft of identity and health data; the actor and country remain undetermined.
Dashlane personal-plan users
May 31, 2026
•[ brute-force, technology, leak ]
Beginning May 31, 2026, attackers sent automated brute-force requests to Dashlane's device-registration API endpoints to guess two-factor authentication codes and register unauthorized devices on targeted accounts. The attackers successfully downloaded encrypted vault copies belonging to fewer than 20 personal-plan users. Dashlane automatically locked targeted accounts, later restored access, and found no evidence that its internal systems or additional customers were affected.
ASOS plc
July 28, 2026
•[ financial, retail, brute-force ]
ASOS detected suspicious customer account activity on July 28, 2026 and confirmed unauthorized access on July 29. Attackers used customer login credentials stolen from unrelated services to access ASOS accounts, exposing personal and partial payment information relating to 138,828 customers. ASOS locked affected sessions, required password resets, and blocked or canceled suspicious transactions. This account-takeover episode is separate from the October 2026 ASOS app-notification incident. The perpetrators were not identified; criminal and financial intent are inferred from the credential-stuffing and suspected fraudulent transactions.
Sogang University
August 11, 2026
•[ hack, brute-force, education ]
An unidentified external attacker accessed Sogang University's integrated login system from an unauthorized overseas IP address on August 11, 2026 using brute-force activity. The university detected the incident on August 14 and confirmed that approximately 180,000 records relating to students, alumni, former students, staff, and other account holders were leaked.
AmplifAI (GoDaddy instance)
November 1, 2026
•[ ransomware, leak, technology ]
AmplifAI (GoDaddy instance) was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Technology. Country: United States of America. GoDaddy AmplifAI Instance Complete Data Dump
================================================
URL: https://godaddy.ampbi.net
Okta SSO: https://godaddy.okta.com
Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI)
Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7
============================================================
USER DATABASE 13,565 unique employees
============================================================
File: all_users.json
Fields per user:
"name": "",
"email": "",
"userseq": ,
"firstname": "",
"lastname": "",
"ad_id": "",
"password": "",
"aduser": "true/false",
"usertype": "1/2/3/4",
"employeenumber": ""
User Type Key:
1 = Admin
2 = Manager
4 = Agent
Breakdown:
Total users: 13,565
AD users (Okta/SSO): 6,184
Non-AD users (local): 16
Admins (type=1): 459
Managers (type=2): 502
Agents (type=4): 5,239
Default password: 13,510
Non-default passwords: 9
============================================================
ORGANIZATIONS 34 total
============================================================
1. Agent Dashboard Organizations
1. DEM Sales_Support - ALL
2. DEM Sales_Support - GDDY
3. DEM Sales_Support - TP
4. GD International Independents
5. GD US Independents
6. Commerce - GDDY
7. Commerce - TP
8. DEM Sales_Support - SGS
9. EMEA Brands - ALL
10. EMEA Brands - GDDY
11. EMEA Brands - TP
12. GAO - GDDY
13. GD Teleperformance
14. Global Messaging Ops - GDDY
15. Global Messaging Ops - Genpact
16. Global Messaging Ops - SGS
17. Global Messaging Ops - TP
2. Performance Dashboard Organizations
18. ROW Sales_Support - ALL
19. ROW Sales_Support - Genpact
20. ROW Sales_Support - SGS
21. Services - SGS
22. US Sales_Support - SGS
3. Analytics Organizations
23. Global Messaging Ops - ALL
24. ROW Sales_Support - TP
25. Services - ALL
26. Services - GDDY
27. Services - TP
28. US Sales_Support - ALL
29. US Sales_Support - GDDY
4. Non Core Care Organizations
30. US Sales_Support - TP
31. Non Core Care - GDDY
32. Non Core Care - Genpact
33. Non Core Care - SGS
34. Non Core Care - TP
============================================================
LOGIN LOGS 4,451 records
============================================================
File: login_logs.json
Fields per record:
"Name": "",
"Title": "",
"Module": "",
"Access Date": "",
"Access Time": "",
"Time Zone": "",
"Access Device": "",
"Primary Program": "",
"Organization": "",
"Location": "",
"Manager Name": "",
"OpsManager Name": ""
Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy
Sample devices: Desktop, Mobile
============================================================
ROSTER DATA 1,201 records (1,193 with @godaddy.com emails)
============================================================
File: roster.json
Fields per record:
"RosterExportID": "",
"companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8",
"employeeid": "",
"email": "",
"fname": "",
"lname": "",
"managerid": "",
"pbxid": null,
"location": "",
"primaryprogram": "",
"title": "",
"recorddate": "",
"hiredate": null,
"termdate": null,
"loginuserid": "",
"customfield1": null,
"customfield2": null,
"customfield3": null,
"customfield4": null,
"customfield5": null,
"customfield6": null,
"customfield7": null,
"customfield8": null,
"customfield9": null,
"customfield10": null,
"otherprogram1": null,
"otherprogram2": null,
"otherprogram3": null,
"otherprogram4": null,
"otherprogram5": null,
"otherprogram6": null,
"otherprogram7": null,
"otherprogram8": null,
"otherprogram9": null,
"otherprogram10": null,
"varcharemployeeid": "",
"varcharmanagerid": "",
"organization": "",
"movedToCosmos": "False",
"glidepathtitle": null,
"gltitleid": null,
"coach": null,
"programstartdate": null,
"RequestID": ""
Roster by Organization:
US Sales_Support - GDDY: 405 records
Global Messaging Ops - Genpact: 191 records
EMEA Brands - GDDY: 176 records
Commerce - GDDY: 135 records
DEM Sales_Support - GDDY: 103 records
ROW Sales_Support - SGS: 101 records
Commerce - TP: 41 records
Non Core Care - Genpact: 37 records
Services - TP: 12 records
----------------------------------------
TOTAL: 1,201 records
25 organizations have no roster data available.
============================================================
PROGRAMS 227 unique GoDaddy call center programs
============================================================
File: programs.json
Categories include:
Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales
Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin)
Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW
Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS
Geographic: UK & IE, CA & AU, LATAM, EMEA, International English
Security: Website Security Sales I/II, Website Security Support
Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services
============================================================
OKTA / ACTIVE DIRECTORY INTEGRATION
============================================================
Okta Tenant: https://godaddy.okta.com
AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7)
Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta)
SAML SSO: SAML 2.0
OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration
Authn API: POST https://godaddy.okta.com/api/v1/authn
(accepts JSON {username, password}, returns sessionToken on success)
Password Grant: Supported (grant_type=password in OIDC config)
AD User Identity Format:
"Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin)
Okta accepts: username, username@godaddy.com, EMAIL format
Reach out on session or be the next headline
https://getsession.org
ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c
www.labexpress.com
May 29, 2026
•[ ransomware, brute-force, healthcare ]
www.labexpress.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Professional Services. Country: United States of America. Website: www.labexpress.com. LABEXPRESS & GARONIT PHARMA: 200 GB OF SHARED INFRASTRUCTURE
We have obtained 200 GB of internal data from a US-based group operating under two legal entities: Labexpress and Garonit Pharma. The materials show a single Active Directory domain (LABEXPRESS1.local), a shared file server, and extensive crosscompany records. This data will be made publicly available in the near future.
Active Directory Overview
- 65 computers, 142 user accounts, 98 groups, 11 organizational units (OUs).
- Domain controllers: DC01 (Server 2019), LABXDC01 (Server 2012 R2).
- A single AD domain serves both Labexpress and Garonit Pharma.
Notable account:
cn: Troy Austin
sAMAccountName: Taustin
memberOf: QuickBooks, LABEXPRESS, LABEXPRESSUSERS
The same person appears in Exchange mailboxes as taustin@garonitpharma.com.
Weak Passwords and BruteForce Indicators
- Administrator account: 3,193 failed logon attempts, last successful logon 2026-04-30.
- Computer accounts FRONTDESK$, DEV$, LABEL$ more than 3,000 failures each.
- Cleartext password found on FILE01\passwords.txt:
Admin: LabExpress2024!
- The Domain Admins group includes: Administrator, labadmin, adminiss, Protect, xtratech, LAE009-CT.
- Password for user Protect: Password123!
- Outdated password templates in the SBSUsers OU are still in use.
Mail Servers and Exchange
- LABSERVER2 runs Windows Server 2003 SP2 with Exchange 2007.
- Full mailbox export performed using the builtin Export-Mailbox cmdlet no special exploit required.
Contents of the Obtained Data (200 GB)
We have data from drive E:\, including:
1. Financial & Accounting
- QuickBooks Enterprise 2021 installer and data files (QB2021.DSN, QB2021.ND).
- Folder: E:\Garonit Documents\Clients 2022\ hundreds of invoices, COAs, and COCs (e.g., Amtrade International INV# 50268.pdf for ~21M USD, Estee Lauder Inv# 24.pdf).
- Folder: E:\Garonit Documents\ACCOUNTS PAYABLES 2022 09 22\ detailed accounts payable records for 50+ vendors.
2. Quality & Production
- Thousands of COA/COC files (e.g., CHG 20% Lot 429012 CoA.pdf, COC CHG 20%, Lot# 705103.docx).
- Complete batch records for 20232026 (folders Batch Records\2023, 2024, 2025, 2026).
- Stability study protocols and raw HPLC data for CHG 0.12% Oral Rinse.
3. ANDA & Regulatory Documentation
- Folder 00 Oral Rinse ANDA-Old One complete ANDA dossier, including DMF, method validation, stability, and correspondence with the FDA.
- Files: ANDA Checklist-Oral Rinse.docx, DMF Assessment in advance.pdf.
4. Vendor & Customer Records
- Folder: E:\Garonit Documents\Vendor from 2022 07 19 TO 2022 09 21\Vendor\ dossiers on each supplier (contracts, invoices, assessments).
- Folder: E:\LABEXPRESSDATA\ALL LEI ORDERS\ customer purchase orders and sales quotations.
5. Human Resources (HR)
- Folder: E:\LABEXPRESSDATA\HUMAN RESOURCES\ employment contracts, W9 forms, tax deductions, resignation letters.
- Passport scans, Green Card copies, health insurance records for many employees.
- Files: Employee Handbook.pdf, PTO Request Form.docx, Time off request form.pdf.
6. Internal Communications & Scans
- Directory C224E BIZHUB SCANNER DUMPS containing subfolders named after employees (Burcu, Frank, Iliany, Kelvin, Dave, Randy, Sudhir, etc.).
- Scans include: Green Cards, IDs, credit card authorization forms, bank letters, and correspondence with the IRS.
- Examples: Burcu Green Card.pdf, Rohit Garg X-Ray.pdf, SKM_C250i... (thousands of scanned documents).
7. Tax & Banking Documentation
- Correspondence with the IRS, State of New Jersey, Valley National Bank, Citibank.
- Files: IRS Notice Lab Express.pdf, Valley Bank Garonit Deceember 2020.pdf, Credit Application, Bank instructions.pdf.
Shared Infrastructure Observed Facts
- The same Active Directory domain and file server (drive E:\) store data for both Labexpress and Garonit Pharma.
- Crosscompany records reside in the same folders (e.g., Garonit Documents and LABEXPRESSDATA coexist on the same drive).
- User Troy Austin has an AD account (Taustin) and also uses the email address taustin@garonitpharma.com.
- Purchase orders, invoices, COA/COC files refer to both companies interchangeably.
- At the IT level, there is no separation between the two legal entities.
The obtained data demonstrates that Labexpress and Garonit Pharma operate on a single, shared IT infrastructure. All files, accounts, mailboxes, and production records are stored on the same systems. A 200 GB archive will be publicly released in the near future.
Fashion Box S.p.A.
January 29, 2025
•[ brute-force, data leak ]
Fashion Box S.p.A., owner of the Replay brand, disclosed a brute-force intrusion on January 29 2025 that allowed unauthorized access to internal servers and the exfiltration of corporate information and personal data of employees and external stakeholders. The company notified multiple European data-protection authorities. No encryption was confirmed. An undisclosed amount of personal and corporate data was taken.
Synthient Credential Stuffing Threat Data
April 11, 2025
•[ hack, brute-force, technology ]
During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources. Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords.
SonicWall
May 9, 2025
•[ hack, brute-force, technology ]
Threat actors brute-forced the MySonicWall portal and accessed cloud backup firewall preference files for a subset of customers (<5%). SonicWall terminated access, issued Essential Credential Reset guidance, and involved law enforcement. Risk centers on reuse of secrets/config intelligence for follow-on compromises.
MALL.cz
July 27, 2017
•[ leak, brute-force, retail ]
In July 2017, the Czech Republic e-commerce site MALL.cz suffered a data breach after which 735k unique accounts including email addresses, names, phone numbers and passwords were later posted online. Whilst passwords were stored as hashes, a number of different algorithms of varying strength were used over time. All passwords included in the publicly distributed data were in plain text and were likely just those that had been successfully cracked (members with strong passwords don't appear to be included). According to MALL.cz, the breach only impacted accounts created before 2015.
General Motors
July 9, 2024
•[ hack, brute-force, manufacturing ]
General Motors (GM) suffers what appears to be a credential stuffing attack, affecting 65 GM MyAccounts.
Amtrak
June 14, 2024
•[ hack, brute-force ]
Amtrak reveals that the Guest Rewards Accounts were hacked in credential stuffing attacks
PetSmart
March 6, 2024
•[ hack, brute-force, retail ]
Pet retail giant PetSmart warns some customers their passwords were reset due to an ongoing credential stuffing attack attempting to breach accounts.
Roku
March 8, 2024
•[ hack, brute-force, technology ]
Roku says it canceled unauthorized subscriptions and refunded more than 15,000 accounts after discovering what they called suspicious activity.
