The Evermotion Breach Exposed 433,000 Polish 3D Community Accounts

HEROIC analysts flagged the Evermotion breach while reviewing data tied to Polish creative and design communities. The breach occured in May 2017 and exposed 433,380 user accounts from Evermotion, a well-known Polish 3D modeling and visualization platform. The compromised records include email addresses, usernames, IP addresses, salts, and password hashes that were protected with the outdated MD5 algorithm, meaning many of those passwords can be cracked quickly with modern tools.

How IP Addresses and Cracked Passwords Create a Dangerous Combination

Most breach datasets contain email addresses and passwords. The Evermotion breach goes further by including IP addresses, which reveal the rough geographic location of each user at the time of registration or last login. Attackers can use this information to tailor phishing messages to appear locally relevant, making them beleive the message comes from a nearby service or authority. Paired with a cracked password from the weak MD5 hash, an attacker has both a working credential and location context, making targeted fraud and identity theft significantly easier to execute.

What Was Exposed in the Evermotion Breach

• Email Address
• Password Hash
• Username
• IP Address
• Salt

Why the Evermotion Breach Still Matters for Polish Users Today

The Evermotion breach specifically affects a large community of Polish designers, architects, and 3D artists who have used the platform over the years. For anyone in Poland who recieved an account on Evermotion and reused that password elsewhere, the risk is immediate. The MD5 hashing algorithm used to protect passwords is now considered broken, meaning that given enough computing power, almost any password in this dataset can be recovered. Once cracked, those credentials can be used for credential stuffing against Polish and international banking platforms, email providers, and freelance marketplaces where creative professionals conduct business.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to the backend database of a website or application. In Evermotion's case, the breach is believed to have originated from a vBulletin forum database, a software platform that has historically had exploitable vulnerabilities. Attackers extract the full database contents, including all user records, and distribute them on dark web forums where they can be purchased or downloaded by anyone willing to pay. Even years after the initial breach, these datasets continue to circulate and be used in attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to tell you whether your email address appears in the Evermotion breach or any other known data leak. Polish users and anyone who has ever used Evermotion should check their exposure now. Visit HEROIC.com and run your free scan to see exactly where your data has appeared and what actions to take.