The Click on Recharge Database Put 680 User Records With MD5 Hashes Online

HEROIC analysts identified a database exposure linked to Click on Recharge, an Indian e-commerce platform, with the breach dated August 4, 2022. The incident affected 680 user accounts and included a combination of contact details and MD5 hashed passwords. While the record count is smaller than many breaches we track, what stood out was the financial platform context: users who registered on an e-commerce recharge service are partcularly likely to have linked payment methods or used the same credentials on banking apps, making even a small breach high-value for targeted attackers.

Why MD5 Password Hashes From an E-Commerce Platform Are Dangerous

MD5 hashes are among the fastest to crack of any password hashing method. With modern GPU-accelerated hardware, billions of MD5 hashes can be tested per second against common password dictionaries. For a small dataset of 680 records, an attacker could attempt to crack every single hash within minutes. Once cracked, the passwords paired with phone numbers and email addresses create a complete contact profile, accessable for both direct account attacks and phone-based social engineering against the victim's bank or carrier.

What Was Exposed in the Click on Recharge Breach

• Email Address
• Phone Number
• Password Hash
• Username

How Exposed Phone Numbers Amplify the Risk of This Breach

The inclusion of phone numbers alongside email addresses and crackable MD5 hashes recieved by this breach creates a multi-vector attack surface. Attackers can use cracked credentials for direct account takeover on Click on Recharge and test the same pairs against email, banking, and other e-commerce services. The phone number enables SIM swapping attempts, where an attacker convinces a mobile carrier to transfer the victim's number to an attacker-controlled SIM, bypassing SMS two-factor authentication on financial accounts. This compounding risk means the harm potential of this breach extends well beyond the 680 records in the original dump.

How a Database Breach Works

A database breach occurs when an unauthorized party gains access to a platform's backend data systems and extracts stored records. For e-commerce platforms, this often occurs through SQL injection attacks against web application inputs, exploitation of outdated software components, or compromised server credentials. Once access is established, attacker can export entire user account tables. The Click on Recharge breach involved extraction of 680 records containing user credentials and contact information, likely then distributed on underground forums or dark web channels where small e-commerce datasets are traded for account takeover purposes.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to determine whether your email address appears in the Click on Recharge breach or any other known data leak. Run a free check now to find out if your credentials are in circulation.