Cyber Incident Victim: Toddycafe.com
Date:
Oct 2020
Location:
Singapore
Summary
A threat actor advertised stolen user databases from seventeen companies, including Toddycafe.com, for sale on a hacker forum, aggregating approximately 34 million records. The seller acted as a broker rather than the original attacker, offering data containing emails, various password hashes, and personal identifiers such as names, addresses, phone numbers, and tax or national ID numbers across the affected entities. Specific to the café platform, exposed information comprised emails with unspecified password protection. While one company acknowledged the breach, most victims had not publicly confirmed compromises at the time of reporting. The datasets originated from diverse sectors, with password hashing methods ranging from weak MD5 to stronger bcrypt implementations in other breaches.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 28, 2020, a threat actor advertised stolen user databases from seventeen companies for sale on a hacker forum, aggregating approximately 34 million records. The seller operated as a data breach broker rather than the original attacker, facilitating the sale of databases obtained from third-party breaches. Toddycafe.com was among the affected entities, with its database containing user email addresses and passwords of unspecified hashing status. The broker’s forum post initiated private sales of these datasets, which typically involved exclusive transactions ranging from $500 to $100,000 before eventual public release. Other prominent victims included Geekie.com.br (8.1 million records), Clip.mx (4.7 million), and Wongnai.com (4.3 million). RedMart publicly acknowledged its breach, but Toddycafe.com and most other listed companies had not confirmed compromises at the time of reporting.
The Toddycafe.com breach exposed user email credentials, though the encryption method for passwords remained unidentified, unlike other victims where specific hashing algorithms like bcrypt or MD5 were documented. The aggregated datasets across all seventeen companies included diverse personal information such as names, addresses, phone numbers, tax identifiers, and payment card details, depending on the source. No remediation efforts or victim notifications by Toddycafe.com were reported. The broker provided samples verifying the authenticity of each dataset, though the article did not specify whether Toddycafe’s data was among those validated. The incident heightened risks of credential-stuffing attacks due to potential password reuse across services, though the narrative did not attribute any subsequent malicious activity directly to the Toddycafe.com breach.