714 Email Addresses and Login Hashes Exposed in Braeworks Breach
HEROIC analysts reported a database leak from Braeworks that holds 714 email addresses and salted login hashes, dated August 1, 2023. The file surfaced on a hacking forum and was later shared again in messaging channels, which pushed it well beyond the original site. Because the breach is reported and not yet confirmed, the only way to know whether your address is inside is to scan your email and see your information.
The records came from the user table of one website, so most of the people in the file once created a login there and may never think about that site again. That quiet gap is exactly why this kind of leak can sit unnoticed. The three data types here, email addresses, hashes and salt values, are enough for someone to start testing login details against other services.
What Was Exposed
Key findingThis breach exposed email addresses and hashed passwords for 714 records.
What the 714 Records Contain
- Email addresses: the main way to find you across other services and to aim phishing messages at your inbox.
- Password hashes: scrambled versions of login secrets that an attacker can test by making guesses and comparing results.
- Salt values: random extra data added to each hash, which slows down reversal but does not stop it.
Why Repeat Leaks Like This Still Hurt
A leak from one site rarely stays on that site. Attackers often try the same email and login pairs on banking, shopping and email services, and a single match can open the rest of your online life. Scam callers can also use the details to sound convincing when they ask for more information.
Over time, the damage may appear as unfamiliar login alerts, messages sent from your address that you never wrote, or calls that quote details you thought were private. None of this proves you were targeted, but it is the pattern that tends to follow when old logins are reused.
Data exposed in this breach
Email addresses appear in 100% of the 714 records in this breach, alongside hashed passwords (74.2%).
Even on their own, leaked email addresses are useful to attackers: they confirm the address is in use and put it on phishing and spam lists.
- Domain
- braeworks.com.au
- Date leaked
- 01 Aug 2023
- Records in breach
- 714
Email providers and account types
61.2% of the email addresses in this breach are personal mailboxes and 38.8% are work addresses. The most common provider is gmail.com, followed by hotmail.com and bigpond.com.
Work addresses matter because a password reused on a company account can give attackers a way into that organisation. The company domains below show which employers appear most often.
Mailbox type
- Personal mailboxes61.2%
- Work mailboxes38.8%
Email providers
- 1gmail.com133
- 2hotmail.com117
- 3bigpond.com38
- 4optusnet.com.au28
- 5yahoo.com23
- 6yahoo.com.au22
- 7bigpond.net.au15
- 8tpg.com.au10
- 9live.com9
- 10iinet.net.au9
- 11msn.com7
- 12hotmail.co.uk3
- 13ymail.com3
- 14me.com3
- 15y7mail.com3
Company domains
| # | Domain | Accounts | Share of records |
|---|---|---|---|
| 1 | internode.on.net | 10 | 1.4% |
| 2 | westnet.com.au | 7 | 1% |
| 3 | live.com.au | 5 | 0.7% |
| 4 | adam.com.au | 5 | 0.7% |
| 5 | braeworks.com | 4 | 0.6% |
| 6 | netspace.net.au | 4 | 0.6% |
| 7 | optushome.com.au | 3 | 0.4% |
| 8 | dodo.com.au | 3 | 0.4% |
| 9 | defence.gov.au | 3 | 0.4% |
| 10 | team.telstra.com | 3 | 0.4% |
| 11 | weddingbandsvictoria.net | 2 | 0.3% |
| 12 | hunterlink.net.au | 2 | 0.3% |
| 13 | hcsu.net | 2 | 0.3% |
| 14 | ausfoodsnews.com | 2 | 0.3% |
| 15 | comtexsecurity.com | 2 | 0.3% |
Password Analysis
What 714 Leaked Logins Let an Attacker Do
Email addresses paired with hashed logins give an attacker a list of who is in the database and a starting point for guessing. If the hashes can be reversed, the attacker holds working login details that can be tried elsewhere. Salt values slow that work down, but they do not make it impossible, especially when many people chose similar details.
Even if the hashes stay hard to reverse, the email addresses alone are valuable for phishing. A message that mentions Braeworks looks believable, so people are more likely to click a link or reply. Attackers often send these messages in bulk, so a small leak can still reach a large number of inboxes.
Is Your Braeworks Login in the Leak?
Start by taking a few minutes to scan your email so you can see your information and whether this file lists you.
If your address appears, change the login you used on Braeworks and watch for emails pretending to come from the site. Then update any other service where you used the same details, so a single leak cannot open the rest.
The same steps apply whether the exposed address is personal or work.
Password storage and hashing
Of the hashed passwords, 100% use MD5 or NTLM. 100% use fast or reversible methods such as MD5, NTLM or SHA-1, which are quick to crack.
Hashing only protects a password if the method is slow. bcrypt, scrypt and Argon2 are designed to slow attackers down; MD5, NTLM and SHA-1 were designed for speed, which makes them easy to crack in bulk.
Hash types
- MD5 or NTLM100%
Leaked in this breach: email address, password hash, salt
Is your email in the Braeworks leak?
Check your email against this breach and billions of other leaked records. If it shows up, we'll tell you exactly what to change.
Scan my email714 records in this breach
- Instant
- Free
- Private
Threat Intelligence
Key finding1 records from braeworks.com.au staff appear in 1 other breaches.
How a Database Leak Like This Happens
A Database file is a copy of the records a service keeps for its own users. Someone reaches the systems behind a site, copies the stored tables, and passes the copy along. The people in it rarely learn their details left the site until strange messages start arriving.
Employees of braeworks.com.au in other breaches
1 records from braeworks.com.au staff turn up in 1 other breaches. The most common sources are DemandScience (Pure Incubation).
Organisations in this position should reset passwords for the affected addresses and require multi-factor authentication.
/img/qr-code.png)