The Eskimi Breach Contains Exactly 1,197,590 Email and Password Hash Records

HEROIC analysts documented the Eskimi data breach, which occured in September 2020 and exposed exactly 1,197,590 user records from the advertising technology platform. The compromised data included email addresses, usernames, MD5 password hashes, and birthdays belonging to registered users of the platform.

Why Unsalted MD5 Hashes and Birthdays Make This Breach Especially Dangerous

MD5 password hashes without salting are accessable to attackers using precomputed rainbow tables, meaning passwords can be recovered in seconds rather than days. When combined with birthdays, attackers gain a powerful tool for answering security questions and bypassing account recovery flows on email providers, banks, and social platforms where users recieved verification challenges.

What Was Exposed in the Eskimi Breach

• Email Address
• Username
• Password Hash
• Birthday

Why AdTech Platform Breaches Enable Targeted Phishing at Scale

Advertising platforms like Eskimi aggregate detailed user profiles. A breach of this type gives attackers verified email addresses paired with usernames and birthdays, enabling them to craft highly personalized phishing messages. These seperate data points combined create a profile that makes social engineering attacks far more convincing than generic spam campaigns.

How Database Breaches Work

A database breach occurs when an unauthorized party extracts data stored in a company's systems, typically by exploiting software vulnerabilities, weak authentication, or insecure configurations. The stolen records are then distributed through underground markets and hacking forums where other threat actors purchase and use them in follow-on attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion records, including the Eskimi breach and thousands of other known data leaks. Visit HEROIC.com to run a free scan and find out if your credentials have been exposed.