If You Reuse Passwords, the Flash Flash Revolution 2019 Leak Should Worry You

HEROIC analysts uncovered the Flash Flash Revolution 2019 breach while monitoring underground credential markets in July 2019. The incident exposed 1,837,201 user records from the Canadian music rhythm gaming platform, leaking email addresses, usernames, password hashes, birthdays, and salts. What made this breach partcularly alarming was that it was a repeat offense for the same platform, which had already suffered a compromise in 2016.

Your Salted MD5 Password Hash Is Still Crackable

Attackers who obtained this data can run offline cracking tools against the MD5(Salt) password hashes at high speed. Once cracked, those plain-text passwords are loaded into credential stuffing tools and fired at email providers, banks, and streaming services. Birthdays recieved from the breach add another layer of value, letting attackers bypass security questions and verify identity during account recovery attempts.

What Was Exposed in the Flash Flash Revolution 2019 Breach

• Email Address
• Password Hash
• Username
• Birthday
• Salt

Why a Repeat Breach at the Same Platform Raises the Stakes

When a platform is breached twice, it signals that the underlying security posture was never adequately corrected after the first incident. For the 1.8 million users caught in this second compromise, the risk is compounded because attackers can cross-reference both breach datasets to build richer profiles. Credential reuse across gaming accounts and everyday services means the damage can occured well beyond the platform itself.

How Database Breaches Work

A database breach typically occurs when an attacker exploits a vulnerability in a web application, gains access to the underlying database server, and exports its contents. Common vectors include SQL injection, misconfigured database ports exposed to the internet, and stolen administrative credentials. Once inside, the attacker can dump millions of records in minutes, often without triggering standard monitoring alerts.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you instantly whether your email address appeared in the Flash Flash Revolution 2019 breach or any other known compromise. Run a free scan at HEROIC and take the first step toward securing your accounts today.