Your Password May Already Be Cracked. BullChart Leaked 10,252 Records.

HEROIC analysts identified a dataset from BullChart, a German financial services platform offering resources and technical analysis for investors and traders, circulating on a hacking forum. Discovered on August 26, 2018, the dataset contains 10,252 records, each pairing an email address with an MD5 password hash.

Why This Is Dangerous

MD5 is a weak, outdated hashing algorithm that attackers can crack quickly using widely available tools. Because this breach involves a financial trading platform, the accounts behind these credentials may still be tied to real investment activity, making them a more valuable target than a typical consumer breach if the password was reused anywhere sensitive.

What Was Exposed in the BullChart Breach

• Email addresses
• MD5 password hashes

Why This Matters for the 10,252 People Affected

Once an MD5 hash from this leak is cracked, the resulting password becomes a key an attacker can try on other accounts. Given that BullChart's users are traders and investors, a reused password could open the door to banking, brokerage, or other financial accounts, turning a years-old breach into present-day financial fraud or identity theft.

How This Database Breach Happened

This incident is classified as a database and combolist breach, meaning attackers obtained a direct copy of BullChart's user table, likely through a vulnerability in the platform's authentication system, and packaged the emails and MD5 hashes for distribution on a hacking forum. From there, the credentials are commonly folded into larger combolists used in ongoing credential stuffing campaigns.

Check If You Are Affected

To find out if your email address or password appears in this leak or any other, run a free scan with HEROIC's breach checker, which searches a database of more than 400 billion leaked records.