The BolsaPHP Breach Data Quietly Appeared on Hacking Forums Back in 2018

In August 2018, BolsaPHP, a Spanish-language online stock trading simulator, quietly lost control of its user database. The breach exposed 28,428 records including email addresses and MD5-hashed passwords. The data was posted to a prominent hacking forum without much notice at the time. Years later, it has reappeared in freshly compiled combolists and is being circulated across Telegram channels focused on credential stuffing. The breach went largely undetected by mainstream media, but the renewed activity around this dataset makes it relevant again today.

Why This Is Dangerous

Platforms focused on financial topics, even simulators, tend to attarct users who also manage real financial accounts. Those users frequently reuse passwords across both simulated and live financial platforms. An attacker holding a BolsaPHP credential list has a targeted pool of likely finantially active individuals, making this data especially valuable for account takeover attempts against banks, brokerages, and investment apps.

What Was Exposed

• 28,428 unique user records
• Email addresses linked to registered accounts
• Password hashes encoded with MD5
• Data from a direct database export
• Originally leaked August 26, 2018
• Platform based in Spain, Spanish-language user base

Why This Matters

MD5 hashes offer minimal real-world protection. Rainbow tables and GPU cracking rigs can reverse the majority of MD5-hashed passwords in seconds. That means the 28,000 accounts exposed in this breach should be treated as plaintext passwords in terms of the threat they pose. The financial interest of the user base multiplies that risk significantly. Any organization with employees or customers who might have used BolsaPHP should flag this dataset as a potential exposure point.

How Combolist Breaches Work

Combolist breaches begin with a database compromise at one platform. The dumped data is sold or traded, then aggregated with other breach sets into large compiled files called combolists. These lists are fed into credential stuffing tools that automatically test login combinations across hundreds of websites and services. The BolsaPHP dataset has been folded into several such lists, meaning it is actively being tested against live services right now. Even a 2018 breach can produce account takeovers in 2025 if users have not changed their passwords.

Check If You Are Affected

HEROIC's free breach scanner searches over 400 billion exposed records, including this BolsaPHP dataset and thousands of other known breaches. Enter your email to see if your credentials are part of any active leak. Early detection is the best defnse against credential-based attacks.