498K Customer Passwords From the Bookchor Breach Just Surfaced on the Dark Web

HEROIC analysts identified the Bookchor database breach, with data first surfacing on January 28, 2021. The breach exposed 498,234 customer records from this Indian eCommerce bookstore, including email addresses, phone numbers, full names, IP addresses, birthdays, gender, and password hashes stored as unsalted MD5. The volume and variety of personal data recieved in this dump makes it particularly useful for attackers seeking to build detailed customer profiles for fraud and social engineering.

How Gender, Birthday, and Unsalted MD5 Hashes Combine Into a High-Value Attack Package

Unsalted MD5 passwords are among the easiest hashes to crack. Without a unique salt per user, attackers can use precomputed rainbow tables to reverse entire batches of password hashes in minutes. When that cracked password is paired with a full name, birthday, gender, phone number, and IP address, the result is a complete profile that can be used for identity theft, SIM swapping, financial fraud, and highly targeted spear-phishing. This combination is accessable to any attacker who purchased the Bookchor dump on dark web marketplaces.

What Was Exposed in the Bookchor Breach

• Email Address
• Password Hash
• Phone Number
• First Name
• Last Name
• IP Address
• Birthday
• Gender

Why the Bookchor Breach Carries Long-Term Identity Theft Risk

With eight distinct data types exposed per record, the Bookchor breach is not a simple credential dump. Birthdays, genders, and phone numbers are seperate categories of harm that persist far beyond the original breach date. These details cannot be changed the way a password can, meaning affected users carry elevated risk indefinitely. Credential stuffing, account takeover, financial fraud, and identity theft all become more feasible when attackers have this level of biographical detail about their targets.

How a Database Breach Works

A database breach occurs when attackers gain unauthorized access to an eCommerce platform's backend database, often through SQL injection, stolen credentials, or misconfigured cloud storage. Once inside, they copy customer records in bulk. In this case, the use of unsalted MD5 for password storage meant that cracking the stolen hashes required minimal effort, dramatically amplifying the breach's impact on affected customers.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion leaked records, including the Bookchor dataset. Enter your email address to find out if your personal information was included in this breach or any other known data leak, and take action to protect your accounts and identity today.