Actor claims sale of 100K-user database from MegaCursos
A threat actor on an underground forum claims to sell a database of about 100,000 user records from MegaCursos, a Spanish-language online course platform. According to the post, the data would include names, emails, hashed passwords, and course interest categories. The claim is unverified and MegaCursos has not confirmed an incident; users should change reused passwords on other services.
What happened
A threat actor on an underground forum claims to sell a database of about 100,000 user records from MegaCursos, a Spanish-language online course platform. The data would include names, emails, hashed passwords, course interest categories, and account flags. The claim has not been independently verified and the platform has not confirmed an incident.
Why it matters
If confirmed, the sale exposes customer contact data and password hashes. According to DailyDarkWeb, weak hashes could be cracked and the passwords reused in credential-stuffing attacks against other services, affecting employees and customers who reuse passwords.
What to do
Ask users of the platform to change reused passwords on other services. Monitor leak channels for confirmation, samples, or an actual sale of the data and trigger the incident response plan if the claim is confirmed.
For the technical team
- Affected
- MegaCursos, plataforma de cursos online em espanhol; base alegada com cerca de 100 mil registros de usuários · MegaCursos, a Spanish-language online course platform; claimed database of about 100,000 user records.
- Exploitation
- Sale advertised on an underground forum by a threat actor, reported by DailyDarkWeb. No confirmed breach: the claim has not been independently verified and MegaCursos has not confirmed an incident.
- Fix
- No fix applicable. Mitigation recommended by DailyDarkWeb: users of the platform should change reused passwords on other services.
- Vector
- Alleged data breach; the source does not describe how the database was obtained. The sample posted by the seller shows password hashes next to emails; according to DailyDarkWeb, if the hashes are weak, cracked passwords could be reused in credential-stuffing attacks against other services.
- More details
- Data alleged in the post: names, emails, hashed passwords, course interest categories, and account flags. DailyDarkWeb classifies the case as an unverified threat-actor claim, not confirmation of a breach. The original forum post is exclusive to source subscribers.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
