The Aditya Birla Fashion and Retail Ltd Dump Contains 4,059,926 Email and Password Hash Pairs

HEROIC analysts identified the Aditya Birla Fashion and Retail Ltd breach after a database containing over four million customer records was made accessable on dark web forums in December 2021. The exposed dataset included email addresses, phone numbers, full names, and MD5-salted password hashes for 4,059,926 users of the Indian fashion retail platform. The breach followed a reported ransom demand that was refused, after which the attackers publicly released the data. Analysts who recieved the dataset confirmed the scope and structure of the records matched the company's customer database format.

Why MD5-Hashed Passwords From a Major Retailer Put Millions at Risk

MD5 is a hashing algorithm that security experts have considered weak for over a decade. Even with salting, MD5 hashes can be cracked far faster than modern algorithms like bcrypt or Argon2 using GPU-accelerated cracking tools. For a breach of this scale, attackers can prioritize the most commonly reused passwords and crack a significant portion of the 4 million hashes in a matter of hours. Once cracked, these credentials enable account takeover on email platforms, shopping sites, and banking apps. The combination of email, phone number, and full name also enables identity theft and social engineering entirely seperate from the password data.

What Was Exposed in the Aditya Birla Fashion and Retail Ltd Breach

• Email Address
• Phone Number
• First Name
• Last Name
• Password Hash

Why a 4-Million-Record Retail Breach Has Lasting Consequences

Retail databases contain the personal details users trust businesses to protect. With over four million records exposed, the Aditya Birla Fashion and Retail Ltd breach creates long-term risk for affected individuals. Victims face credential stuffing attacks against any platform where the same email and password combination was used, targeted phishing using real names and phone numbers, and financial fraud. Phone numbers in combination with full names can be used in SIM swapping attacks to bypass two-factor authentication on bank accounts. The ransom-then-leak pattern seen in this breach is also partcularly damaging because it means the data was intentionally released for maximum exposure.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a company's backend data storage systems, typically through SQL injection, stolen credentials, or exploitation of unpatched vulnerabilities. In cases involving ransom demands, attackers first exfiltrate the data and then threaten to publish it unless payment is made. When companies refuse, the data is released publicly on hacking forums, making it freely available to any criminal who downloads it.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including data from the Aditya Birla Fashion and Retail Ltd breach, to tell you immediately whether your email address has been compromised. Scan your email for free at HEROIC and find out if your information is circulating on the dark web.