have any theories emerged as to how they managed to collect so many creds?
I've analyzed some breaches where MSPs will use the same credentials in network infrastructure across all their customers, but even with that angle, it boggles the mind to get to 70k-80k.
Adrian —dangerously-skip-permissions Sanabria
npub19v…md56q
2026-10-09 20:10:48 UTC
in reply to nevent1q…wlh5
Author Public Key
npub19vvjtrp3pk6kpcd6lq8q9m6svpyns7nwsvezd0ensp0z7atjmhusqmd56qSeen on
wss://relay.momostr.pinkPublished at
2026-10-09 20:10:48 UTCEvent JSON
{
"id": "749b18a72e77836845b7cfc4e413d4b15fc448acc296530239a3bc3ed990a633",
"pubkey": "2b19258c310db560e1baf80e02ef506049387a6e833226bf33805e2f7572ddf9",
"created_at": 1791576648,
"kind": 1,
"tags": [
[
"p",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"e",
"1e147849a058da2de24cc70e6f4dc1b26003269e6cce660d566144690e656192",
"",
"reply",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"e",
"bd668d6c3806ad81ef0372e6d8cab7babd01145873f3ab1af6098f176d233a80",
"",
"root",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"proxy",
"https://infosec.exchange/@sawaba/117412767222066066",
"web"
],
[
"proxy",
"https://infosec.exchange/users/sawaba/statuses/117412767222066066",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/sawaba/statuses/117412767222066066",
"pink.momostr"
],
[
"-"
]
],
"content": "have any theories emerged as to how they managed to collect so many creds?\n\nI've analyzed some breaches where MSPs will use the same credentials in network infrastructure across all their customers, but even with that angle, it boggles the mind to get to 70k-80k.",
"sig": "a964806fcb8b671eac986e6926b61bba0ccf3478a58952f81c40ac10adbb0f598f5853d6e2ba9da453241bc21439d803dfe674acee83803313d3679bac7f3ae1"
}