Attackers spill plaintext passwords of 46k Myspace93 users after 2021 breach

A reported 2021 attack on the Myspace93 parody web art site resulted in exposed plaintext usernames and passwords for more than 46,000 registered users. The breach data was later ingested by HaveIBeenPwned, which also identified exposed email addresses and IP addresses. The Myspace93 site is an offshoot of the Windows93 project, both spoofing older social media and operating system experiences. The co-creator, using the alias jankenpopp, attributed the leakage to trusted members of a Windows93 Discord channel who received access to a beta app. The co-creator said the members used that access to steal server files and access an unencrypted credential store, and delayed disclosure.

"Users of the Myspace93 parody web art site be warned: the dataset spilled after a reported breach in 2021 included the plaintext usernames and passwords of more than 46,000 registered users. The site's co-creator has blamed "trusted members" of a Windows93 Discord channel for the leakage."

"The figure of 46,000+ users is a recent estimate from HaveIBeenPwned (HIBP) - the web's go-to breach aggregator - which ingested the related data this week, more than five years after the January 2021 attack. In addition to the clear-as-day passwords and usernames, HIBP said email addresses and IP addresses were also among the exposed data."

"Janken explained that the breach came about after they shared a beta app with trusted members of the Windows93 Discord channel. According to Janken, those members betrayed the co-creator and used their access to the beta application to steal server files and gain access to an unencrypted credential store. "None of them alerted me immediately to what was going on," Janken wrote."

""On the contrary, they created a program to download our entire server, and it was only a week later that another honest user alerted me to the fact that these people were bragging about having the Myspace passwords. They didn't want to tell me the truth, and it took me two days to get a confession from them: not only had they downloaded all the source files of Windows93 behind my back, but also the unencrypted file containing the passwords of more than 45k Myspace users.""

Read at theregister