Emails, MD5 Hashes Exposed in CKLQ Breach: 3,487 Records

CKLQ Data Leak Exposes 3,487 Accounts

HEROIC analysts identified a data leak tied to CKLQ, the mobile-optimized landing page for a Canadian radio station, that was shared on a hacking forum on August 26, 2018. The exposed dataset affects 3,487 individuals and contains email addresses along with MD5 password hashes tied to those accounts.

Why the CKLQ Leak Is Dangerous

The danger in this leak comes down to two things: the data is tied directly to real people, and the password protection behind it is outdated. MD5 is a hashing method that was considered standard years ago but is now considered weak, since modern computing hardware can crack most MD5 hashes into their original passwords in a short amount of time. Combined with an email address, a cracked password gives an attacker a working login pair that can be tested against other websites.

What Was Exposed in the CKLQ Breach

• Email addresses
• Password hashes (MD5)

Why This Matters for CKLQ Users

Even a small leak like this one can have outsized consequences. Attackers routinely take email and password pairs from old leaks and run them against banking sites, email providers, and social media platforms in a technique called credential stuffing. If a CKLQ user reused their email password combination anywhere else, that account is now at risk of takeover. From there, a compromised account can be used for identity theft, financial fraud, or as a launchpad for phishing attacks against the victim's contacts.

How Database and Combolist Breaches Work

This incident is classified as a database breach that was later repackaged into a combolist. A database breach typically happens when an attacker gains unauthorized access to a website's backend, often through a vulnerability in the site's code, a stolen administrator credential, or an unpatched server. Once inside, the attacker exports user records directly from the database, including any stored password hashes. That raw data is then commonly reformatted into a combolist, a simple file pairing each email address with its password or hash, which makes it easy for other criminals to plug into automated credential stuffing tools.

Check If You Are Affected

If you have ever used your email address on a site connected to CKLQ or a similar regional media property, it is worth checking whether your information has surfaced in this or any other leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to show you where your data has been exposed, so you can change passwords and secure your accounts before criminals act on it.