Dark Web Intel: 60,855 Credentials From the Con Luz Propia Database Dump

HEROIC analysts recieved confirmation of the Asociacion "Con Luz Propia" breach through a routine dark web intelligence sweep in August 2018. The now-defunct Spanish non-profit, based in Cordoba and dedicated to supporting women and girls with disabilities, had 60,855 user records exposed in this database breach. The compromised data includes email addresses and MD5 password hashes, a combination that is partcularly concerning given how thoroughly MD5 has been broken by modern cracking tools over the years since this breach first occured.

Why MD5 Hashes From a Non-Profit Breach Still Pose Real Credential Risks

MD5 is a cryptographic hash function that was never designed for secure password storage, and it has been considered fully compromised by security researchers for well over a decade. Attackers holding the Asociacion "Con Luz Propia" hash data can run them against rainbow tables or GPU cracking rigs to recover the original passwords. Because non-profit volunteers and donors often reuse passwords across personal and professional accounts, a cracked hash from this breach can lead to account takeover on banking apps, email providers, and workplace systems, with identity theft and financial fraud as downstream consequences.

What Was Exposed in the Asociacion "Con Luz Propia" Breach

• Email Address
• Password Hash

Why Dark Web Credential Dumps From Defunct Organizations Are Hard to Escape

When an organization shuts down, the affected users beleive there is no one left to notify them. Asociacion "Con Luz Propia" is no longer operating, which means the 60,855 people whose data was exposed have almost certainly never recieved a breach notification. Data from defunct organizations circulates in underground markets and Telegram channels for years, continuously refreshing the pool of credentials available for credential stuffing campaigns. Anyone who registered on the platform and reused that password elsewhere faces ongoing exposure to account takeover, identity fraud, and financial theft.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a website's backend data store, typically by exploiting a vulnerability in the web application, a SQL injection flaw, or weak server credentials. Once access is obtained, the attacker exports the user table containing every registered email address and its stored password hash. In cases involving MD5 hashes like Asociacion "Con Luz Propia", cracking the passwords offline requires minimal resources, converting what appears to be a hash into an immediately usable plaintext credential.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records, including data from the Asociacion "Con Luz Propia" breach. Enter your email address now to see instantly whether your credentials have been captured in this or any other known breach, and take action to protect your accounts before attackers do.