The CNWHS Breach Happened in 2018. The Passwords Are Still Exposed.

The breach tied to CNWHS, the online platform for the Chicago and North Western Historical Society, happened back on August 26, 2018. HEROIC analysts found that 12,958 records, email addresses paired with MD5 or PHPass hashed passwords, are still circulating on a prominent hacking forum today, years after the original compromise.

Why the CNWHS Breach Is Still Dangerous

A breach from 2018 might feel like old news, but the passwords in it do not expire. MD5 hashes in particular are easy for modern computers to crack, and once cracked, those old passwords can still open current accounts if the same password has never been changed.

What Was Exposed in the CNWHS Breach

• Email addresses
• Password hashes (MD5 and PHPass)

All 12,958 records came from the same database compromise, dated August 26, 2018.

Why This Matters Even Years Later

People tend to reuse passwords for years, which means a password cracked from this 2018 breach could still work on an account you use today. That kind of match gives attackers an opening for credential stuffing across your email, banking, or shopping accounts, which can lead to account takeover, identity theft, or financial fraud.

How a Database and Combolist Leak Like This Happens

Attackers break into a site's backend, often through an unpatched vulnerability, and copy out the user database of emails and password hashes. That data gets turned into a combolist, a simple file pairing each email with its password or hash, and shared or sold on hacking forums, which is how the CNWHS data has stayed in circulation.

Check If You Are Affected by This Leak

If you ever had an account with CNWHS or want to know whether your email appears in this or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a free scan and update any old passwords you may still be using.