Dark Web Intel: RotaryMower’s 13,764 UK Records Are Circulating

HEROIC analysts identified 13,764 records tied to RotaryMower, a UK-based shopping website, dated October 16, 2018. The exposed data includes email addresses and MD5 password hashes, and the records have been observed circulating as part of combolists.

Why the RotaryMower Breach Is Dangerous

MD5 is a weak hashing method that is straightforward to crack with widely available tools, particularly for common passwords. Once cracked, a password paired with its matching email address becomes a working login an attacker can try elsewhere. The fact that this data appears in combolists means it has already been bundled with other leaked credentials for exactly that purpose.

What Was Exposed in the RotaryMower Breach

• Email addresses
• MD5 password hashes

Why This Matters

A combolist is built specifically for credential stuffing, where attackers run large batches of email and password pairs against popular websites to find accounts where the password still works. Anyone who reused their RotaryMower password on another account, especially email, banking, or shopping sites, faces a real risk of account takeover, identity theft, or financial fraud, even years after the original site is gone.

How a Database Breach Becomes a Combolist

A breach like this one usually starts when attackers exploit a vulnerability in a website's backend or find an exposed database, then copy out the user table containing emails and hashed passwords. From there, the data gets combined with records from other breaches into a single file called a combolist, which is traded and reused by criminals long after the original site is forgotten. Weak hashing like MD5 makes the passwords inside especially easy to recover, which is part of why old breaches like this one keep resurfacing.

Check If You Are Affected

If you ever had an account with RotaryMower or think your information could be part of this or another breach, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a free scan to see what's exposed and which passwords to change.