The Galson Labs Data Quietly Appeared on a Forum in 2018

HEROIC analysts reviewed a dataset attributed to Galson Labs, a Canadian industrial hygiene laboratory now operating as SGS Galson, that was posted on a cybercrime forum with a leak date of August 26, 2018. The dataset contains 4,225 records made up of email addresses and MD5 password hashes. Galson Labs has not publicly confirmed this incident, so the attribution comes from the forum listing itself rather than an official disclosure, though the exposed credential pairs are real and worth checking regardless of the source.

Why This Is Dangerous

MD5 hashing is decades old and can be cracked quickly with tools freely available online, especially for passwords that are not long or unusual. A password hash sitting in a dataset like this is closer to a locked door with a spare key under the mat than a genuine barrier. For anyone whose password was simple, it may already be reversible into plain text by whoever downloads this file.

What Was Exposed

• Email addresses
• Password hashes, using the MD5 algorithm

Why This Matters

Cracked passwords from a dataset like this become fuel for credential stuffing, where attackers try the same email and password combination across banking, email, and shopping sites, betting on the fact that people often reuse passwords. Because this data has quietly sat on a cybercrime forum since 2018, anyone who never got around to changing their password on this or related accounts remains exposed to account takeover, identity theft, and financial fraud today.

How Database and Combolist Breaches Happen

Breaches like this usually start with an attacker exploiting a weakness in a company's website or database, such as an unpatched flaw, a misconfigured server, or stolen admin credentials, and using it to pull a full copy of the user table. That table, with emails and password hashes intact, often gets combined with data from unrelated leaks into a combolist and then shared or sold on cybercrime forums. The hashes travel with the emails the entire way, which is why weak hashing algorithms like MD5 make these leaks especially risky.

Check If You Are Affected

If you ever had dealings with Galson Labs or SGS Galson, or if you tend to reuse passwords across accounts, it is worth checking whether your information shows up here. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can see your exposure and update any passwords still in use.