DesignBuilder Data Breach Exposes 57,458 Records with MD5 Password Hashes

HEROIC's DarkHive intelligence system discovered the DesignBuilder breach, exposing 57,458 records from this UK-based professional software provider. The breach occurred in August 2018 and included email addresses and MD5 hashed passwords from registered users of designbuilder.co.uk. DesignBuilder develops building energy simulation software used by architects, engineers, construction professionals, and energy consultants worldwide, meaning the exposed records likely belong to professionals with access to sensitive building designs, energy system specifications, and client project data.

Why This Is Dangerous

MD5 is a cryptographic hashing algorithm that was never designed for password storage and is now considered thoroughly broken for this purpose. MD5 hashes can be reversed using precomputed rainbow tables containing billions of common password hashes, meaning many of the 57,458 exposed passwords can be recovered by attackers within minutes using freely available tools. DesignBuilder serves a professional user base of architects and engineers who commonly use the same credentials across multiple professional platforms, project management systems, and client portals. A compromised DesignBuilder account password that is reused elsewhere gives attackers access to sensitive building specifications, energy audit reports, and client contact information stored in professional systems.

What Was Exposed

• Email Addresses
• MD5 Password Hashes

Why This Matters

Professional software platforms serving technical industries present a higher-value target than general consumer sites because their users tend to have access to proprietary client data, project files, and specialized systems. A building energy software user whose credentials are compromised may have the same password protecting access to engineering firm networks, client project repositories, or building management systems. The MD5 hashing used in this breach provides minimal protection, as the algorithm was deprecated for security use long before this breach occurred. Credential stuffing attacks using this dataset can target professional accounts across the architecture, engineering, and construction sectors.

How Database Breaches Work

A database breach occurs when attackers exploit vulnerabilities in web application code, server configurations, or supporting infrastructure to gain unauthorized access to the backend database. Software vendors like DesignBuilder maintain user registration databases for license management and support access, making them targets for attackers seeking professional credentials. Once the database is extracted, user email and password hash pairs are distributed through breach forums and integrated into credential stuffing toolkits. The continued circulation of this 2018 dataset years after the original breach demonstrates how long stolen credentials remain in active use across the threat intelligence ecosystem.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the DesignBuilder breach. Visit heroic.com to check if your information was exposed. If you have registered an account at designbuilder.co.uk, treat your email and password combination as compromised and immediately update that password on all services where it was reused, prioritizing professional and client-facing platforms.