Staminus Data Breach (2016): What Was Exposed & What To Do

Breaking down the breach

In March 2016 the company stated it had been massively hacked. The event produced an outage exceeding 20 hours and resulted in the disclosure of customer credentials stored as unsalted MD5 hashes, support tickets, credit card numbers and additional sensitive data. The material was subsequently released to the public. Staminus is no longer in operation. No further technical details on the method of access or the precise volume of records beyond the 27,000 unique email addresses have been disclosed.

How a breach like this happens

Incidents involving the compromise of stored credentials and payment data commonly begin with an attacker obtaining access to internal systems through unpatched software, weak authentication controls or stolen administrative credentials. Once inside, the attacker can locate and copy databases containing user accounts, hashed passwords and transaction records. Public release of the material can follow if the data are exfiltrated and later posted on file-sharing or leak sites. The use of unsalted MD5 hashes, when present, reduces the computational effort required to recover original passwords from the stolen files.

About Staminus

Staminus operated as a DDoS protection provider, supplying mitigation services to organisations that needed to maintain availability during network attacks. Companies in this sector routinely collect and retain customer account information, payment details and operational logs to deliver and bill for their services. Exposure of such records is consequential because the data can be reused for account takeover attempts or fraud, and because the customers themselves often operate online services that rely on continuous uptime.

The information in question

The records reported as exposed include credit card numbers, email addresses, IP addresses, passwords stored as unsalted MD5 hashes, support tickets and usernames. The exact scope of each category and whether additional fields were present remain unconfirmed beyond the 27,000 unique email addresses identified in the released material.

The real-world impact

Individuals whose credit card details and unsalted password hashes were included may encounter fraudulent transactions or attempts to access other online accounts that reuse the same credentials. Organisations that relied on Staminus for protection lost service for more than 20 hours, which could have affected their own customers. Because the data were released publicly, the information remains available for continued misuse without further action by the original attackers.

What to do if you're exposed

Check bank and credit card statements for unauthorised activity and request replacement cards if any Staminus-linked payment details appear. Change passwords on any other services that used the same credentials, and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address to determine whether their information appears in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.