The CarDatabase Leak: 16,072 MD5 Password Hashes Hit the Dark Web

HEROIC analysts identified a dataset from CarDatabase, a now-defunct U.S.-based informational platform for cars and automobiles, circulating on a hacking forum. Discovered on August 26, 2018, the dataset contains 16,072 records, each pairing an email address with an MD5 password hash.

Why This Is Dangerous

MD5 is a weak, outdated hashing algorithm that attackers can crack quickly using freely available tools. Because CarDatabase no longer operates, none of these credentials will ever be reset by the original site, meaning any password that gets cracked from this dump stays useful to attackers indefinitely, especially against people who never changed that password anywhere else.

What Was Exposed in the CarDatabase Breach

• Email addresses
• MD5 password hashes

Why This Matters for the 16,072 People Affected

A cracked password from an old, defunct site is only dangerous if it was reused elsewhere, but password reuse remains extremely common. Attackers use exactly this kind of leaked data for credential stuffing, testing stolen email and password pairs against banking, email, and shopping accounts, which can quickly turn into account takeover, identity theft, or financial fraud.

How This Database Breach Happened

This incident is classified as a database and combolist breach, meaning attackers obtained a direct copy of CarDatabase's user table, likely through a vulnerability in the platform before it shut down, and packaged the emails and MD5 hashes for distribution on a hacking forum. Since then, the data has likely been folded into larger combolists that continue to circulate years after the original site went offline.

Check If You Are Affected

To find out if your email address or password appears in this leak or any other, run a free scan with HEROIC's breach checker, which searches a database of more than 400 billion leaked records.