If You Had an mxn.idv.tw Account, Your MD5 Password Hash Leaked

mxn.idv.tw Data Breach: 12,908 Accounts Exposed

HEROIC analysts found a dataset connected to mxn.idv.tw (創作帝國), a now-defunct Taiwanese creative writing portal once used for sharing song lyrics, personal writing, and emotional stories, circulating on a hacking forum. The breach, dated August 26, 2018, exposed 12,908 user records, each containing an email address and an MD5 password hash.

Why This Is Dangerous

MD5 is an outdated hashing algorithm that modern computers can crack quickly using freely available tools and precomputed lookup tables. A hashed password is not the same protection it used to be. For most of the passwords in this dataset, converting the hash back into the original password is a matter of minutes, not months, putting affected users at real risk even though the platform itself is no longer running.

What Was Exposed

• Email addresses
• MD5 password hashes

Why This Matters

Once an MD5 hash is cracked, it becomes a plaintext password just like any other, ready to be tested against email providers, banking sites, and social media accounts through credential stuffing. Because mxn.idv.tw shut down years ago, some former users may assume their old account no longer matters. But if that same password protects an active account today, this 2018 breach is still a live threat to it.

How Database and Combolist Breaches Work

This breach began as a direct database compromise: attackers accessed mxn.idv.tw's backend and pulled out user records wholesale, including hashed passwords, a "database" breach. From there, the data was folded into combolists, the compiled email-and-password files that criminals build by combining many breaches together and using them to test logins at scale across unrelated websites.

Check If You Are Affected

If you ever created an account on mxn.idv.tw or a similar site, HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records. Run a scan to see if you were affected, and if so, update that password anywhere else you may still be using it.