Musical Express Breach: Exactly 13,796 Email and Password Pairs

Musical Express Data Breach: 13,796 Accounts Exposed

HEROIC analysts traced a dataset posted to a hacking forum on August 26, 2018, containing account records from Musical Express, a Brazilian retailer of musical instruments and accessories based in Jundiaí, São Paulo. The compromised database exposed 13,796 records, each containing an email address paired with a plaintext password. Because the passwords were never hashed before the breach, they are readable exactly as customers typed them.

Why This Is Dangerous

Plaintext passwords remove the one obstacle that normally protects a stolen database: encryption. Instead of needing to crack a hash, anyone who obtains this dataset can read every password directly. Combined with a matching email address, that is enough to attempt a login on Musical Express itself, or on any other site where a customer reused the same password.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Email and plaintext password combinations are exactly what fuels combolists, the compiled credential lists that attackers feed into automated credential stuffing tools. If a Musical Express customer used the same password for their email account or online banking, this breach gives attackers a direct path to those accounts too. Even though this breach dates back to 2018, old credential dumps continue to circulate and get tested against new services for years after they first appear.

How Database and Combolist Breaches Work

This incident combines two related breach types. First, attackers gained access to Musical Express's backend database and exported user records directly, a "database" breach. Once that data reached hacking forums, it became raw material for a "combolist," a simple text file of email and password pairs that other criminals compile from multiple breaches and reuse as ready-made ammunition for large-scale login attempts across unrelated websites.

Check If You Are Affected

If you have ever had an account with Musical Express or a similar online retailer, HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including older breaches like this one. Run a scan to see if your information was exposed, and change any password you may still be reusing.