The Maza.la leak source indexed by leaksear.ch covers the Maza/Mazafaka cybercrime forum and contains 3,000 indexed records from a March 3, 2021 breach, including usernames, email addresses, password fields, certificate-related credentials, and messaging identifiers (leaksear.ch metadata). Public reporting at the time described Maza as an old, invite-only Russian-speaking cybercrime forum whose member data was dumped online after a compromise (therecord.media, www.bleepingcomputer.com).
What happened
Public reports described the incident as an unknown attacker compromising Maza Faka on March 3, 2021. The Record reported that the attacker shut down the Tor-based site and placed a PDF containing about 3,000 users' details on the forum's front page; BleepingComputer reported that the leaked data appeared during a broader wave of attacks on Russian-speaking hacker forums (therecord.media, www.bleepingcomputer.com).
Attribution remains unconfirmed. KrebsOnSecurity reported that Maza was one of several long-running Russian-language cybercrime forums hit in the same period, including Verified and Exploit, and that forum members were concerned the leaked identifiers could connect users across forums and to real identities (krebsonsecurity.com).
What data was exposed
leaksear.ch indexes email, password, and username as searchable fields for this source; stored context fields include user IDs, masked account-password values, certificate filenames, certificate-related credentials, and AIM, ICQ, MSN, Skype, and Yahoo identifiers (leaksear.ch metadata).
Public reporting aligns with that field set: BleepingComputer reported user IDs, usernames, email addresses, redacted passwords, certificate file names, certificate passwords, and ICQ, AIM, Yahoo, MSN, and Skype contact details; The Record reported usernames, emails, account passwords, social media IDs, and certificate information (www.bleepingcomputer.com, therecord.media).
Why this matters
Email addresses paired with usernames and password fields create phishing and credential-reuse risk if those identifiers were reused outside the forum (leaksear.ch metadata). Legacy messenger IDs such as ICQ, AIM, Skype, MSN, and Yahoo can link a pseudonymous forum account to other aliases or profiles; KrebsOnSecurity specifically noted ICQ numbers as a cross-forum correlation point for researchers (krebsonsecurity.com). Certificate-related credential fields matter because public reporting said Maza used certificate files and certificate passwords as an added login factor, so their exposure weakens the separation between forum identities and authentication artifacts (www.bleepingcomputer.com). If you reused a Maza email, username, or password on another service, check whether your data appears in this leak and rotate any matching credentials before responding to related messages (leaksear.ch metadata).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by email, password, and username.