Identity Theft Risk Rises as Gaikao Leak Exposes 18,362 Accounts

HEROIC analysts reviewed a dataset attributed to Gaikao, a Taiwanese manufacturer of microcomputer-based controllers and servo motor systems, that appeared on a cybercrime forum with a leak date of August 26, 2018. The dataset contains 18,362 records made up of email addresses and MD5 password hashes. Gaikao has not confirmed this incident directly, so it should be treated as an unverified but real dataset circulating under the company's name.

Why This Is Dangerous

Once a password is turned into an MD5 hash, it looks secure, but MD5 is old and fast to crack with modern hardware, especially for anything shorter than a long, random phrase. That means a meaningful share of the 18,362 password hashes in this dataset can likely be reversed into working passwords without much effort, turning what looks like protected data into a usable credential list.

What Was Exposed

• Email addresses
• Password hashes, using the MD5 algorithm

Why This Matters

The real danger of a leak like this rarely stops at one account. Attackers take cracked email and password combinations and run them through credential stuffing tools against banking sites, email providers, and online shops, betting that at least some of the 18,362 people in this dataset reused the same password elsewhere. Every successful match increases the risk of account takeover, identity theft, and direct financial fraud, well beyond whatever Gaikao's own systems held.

How Database and Combolist Breaches Happen

This kind of leak typically begins when an attacker finds a way into a company's database, whether through an unpatched vulnerability, a misconfigured server, or compromised admin access, and copies out the user table in full. From there, the stolen emails and password hashes are frequently folded into a combolist alongside data from other unrelated leaks and then shared or sold on cybercrime forums, exactly where this dataset was found. The password hashes stay paired with the emails throughout, which is why the strength of the original hashing method matters so much for how usable the stolen data becomes.

Check If You Are Affected

If you have ever interacted with Gaikao or simply want to know whether your email address shows up in this or any other leak, it is worth checking directly rather than assuming you are in the clear. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can see your exposure and update any passwords that need it.