Pemiblanc Data Breach (2018): What Was Exposed & What To Do

In April 2018, a credential-stuffing list known as Pemiblanc was discovered on a server in France. The list contained 111 million email addresses and passwords that had been collected from prior incidents and compiled for use in account takeover attempts against other online services. The discovery was reported on 2 April 2018. Public information about the incident remains limited to the existence and contents of the list itself.

What happened

The Pemiblanc list was found on a French server in April 2018. It held 111 million email-and-password pairs assembled from multiple earlier data breaches. The material was structured for credential-stuffing attacks rather than being the direct result of a single new intrusion into one system.

No further technical details, such as the precise method of compilation or the identity of the server operator, have been disclosed in public reporting.

How a breach like this happens

Credential-stuffing lists are typically built by aggregating usernames and passwords that have already appeared in unrelated breaches. Attackers then test those combinations against other services where users may have reused the same credentials.

The process requires no new compromise of the target organisation; it relies instead on the reuse of previously exposed authentication data across different platforms.

About Pemiblanc

Pemiblanc refers to the name given to the compiled list rather than to a single operating organisation. Such datasets are assembled from records that originally belonged to many separate services and are then used to probe accounts elsewhere.

Because the list draws on credentials from varied sources, its discovery highlights the downstream effects that follow when authentication data from any one service circulates beyond its original context.

The information in question

The list is reported to contain only two categories of data.

• Email addresses
• Passwords

Exact details on password formats, whether any were hashed, or additional fields have not been confirmed publicly.

The real-world impact

Individuals whose credentials appear on the list face an elevated risk that the same combinations will be tested against other accounts they hold. Services that do not enforce unique passwords or multi-factor authentication are most exposed to this form of automated attack.

For any organisation whose earlier breach contributed records to the list, the incident underscores the long-term consequences of credential exposure even after the original event has been addressed.

If your data was in this breach

Change passwords on any accounts that reuse the exposed credentials, and enable multi-factor authentication wherever it is available. Review login activity on important services for signs of unauthorised access.

Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.