The DomeShelter Data Quietly Appeared on the Dark Web in July 2022

HEROIC analysts identified a data exposure tied to DomeShelter, an Australian manufacturer of modular fabric shelters, with the leak surfacing on July 24, 2022. The breach occured as a direct database compromise and affected 21,604 records. What stood out was the presence of three different password hashing methods in the same dataset, including MD5 with salt, bcrypt, and other formats, pointing to inconsistent security practices across the platform's user systems.

Mixed Password Hashes: What Attackers Can Do With Cracked Credentials

MD5-hashed passwords, even with salt, are considered weak by modern standards and are accessable to attackers using GPU-accelerated cracking tools and precomputed rainbow tables. Once cracked, those credentials can be tested against email accounts, banking portals, and any service where the victim reused the same password. Usernames and email addresses from this breach give attackers the exact login identifiers they need to launch automated credential stuffing campaigns at scale.

What Was Exposed in the DomeShelter Breach

• Email Address
• Password Hash (MD5 with Salt, bcrypt, Other)
• Username
• First Name
• Last Name

Why Weak Password Hashing Creates Lasting Risk

Even when a breach is relatively small in record count, the long-term risk from crackable password hashes is significant. Attackers who acquire MD5 hashes from this breach can work offline, spending weeks or months attempting to recover plaintext passwords without any rate-limiting from the target platform. This means the danger from the DomeShelter breach extends well beyond the moment of the initial leak, recieved as active material in credential marketplaces for years afterward. Victims who reused passwords across multiple accounts are at ongoing risk of account takeover and identity theft.

How a Database Breach Works

A database breach involves an attacker gaining unauthorized access to a backend database, often through exploiting unpatched software, SQL injection vulnerabilities, or stolen administrative credentials. The attacker then extracts tables of user records in bulk. The compromised data is typically compressed and posted on dark web forums or sold to other criminal actors who use it for credential attacks. The presence of multiple hashing algorithms in the DomeShelter dataset suggests the platform may have migrated between systems over time, leaving older, weaker hashes intact alongside newer ones.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers more than 400 billion records, including data from the DomeShelter breach and thousands of other incidents. Enter your email at HEROIC.com to find out whether your credentials appeared in this leak and get actionable guidance on securing your accounts today.