Brown Lee Jewelers Breach: 26K Passwords Open Door to Fraud

HEROIC analysts identified a dataset tied to Brown Lee Jewelers, an e-commerce jewelry retailer, circulating on a cybercrime forum. The breach is dated August 26, 2018, and involves roughly 26,006 records. The exposed data includes email addresses and password hashes stored using the MD5 algorithm.

Why This Is Dangerous

MD5 is an outdated hashing method that can be cracked quickly with modern computing power, especially for passwords that are short, common, or reused across multiple sites. Once an attacker converts a hash back into a plain-text password, they have a working email and password combination they can try on other services. If a Brown Lee Jewelers customer reused that password anywhere else, from email to banking apps, that account is now at risk too.

What Was Exposed

• Email addresses
• Password hashes (MD5)

Why This Matters

Email and password pairs are the raw material of credential stuffing attacks, where automated tools test stolen logins against hundreds of other websites at once. Because MD5 hashes are relatively easy to crack, this exposure meaningfully increases the odds that affected customers could see unauthorized logins, account takeover attempts, or follow-on phishing emails crafted to look like they come from a trusted retailer.

How Database and Combolist Breaches Happen

This incident is categorized as a database and combolist breach. In practice, that means the underlying data was likely pulled directly from a website's user database, then repackaged into a combolist, a simple text file pairing emails with passwords, so it can be sold or traded easily among criminals. Combolists are prized on cybercrime forums because they let attackers automate login attempts across many sites at once without any manual effort.

Check If You Are Affected

If you have ever shopped with Brown Lee Jewelers, it is worth checking whether your information appears in this or any other breach. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to show you where your email and passwords have been exposed, so you can change reused passwords before someone else uses them first.