467,901 Passwords From the gl3a.com Breach Are Circulating on the Dark Web

HEROIC analysts flagged a database breach at gl3a.com, a now-defunct Arabic image editing software website based in Saudi Arabia, that occured in April 2020 and exposed 467,901 user records. The compromised data included email addresses and MD5 password hashes, credentials that remain accessable to threat actors and continue to circulate on dark web forums and Telegram channels years after the original incident.

MD5 Hashes and Email Addresses Enable Credential Stuffing at Scale

Attackers who acquire the gl3a.com dataset can use widely accessable rainbow table tools to reverse the MD5 password hashes into plaintext within minutes. Those cracked passwords are then run against email providers, social media platforms, and banking portals through automated credential stuffing bots. Arabic-speaking users are partcularly at risk if they reused their gl3a.com password on other regional or global services.

What Was Exposed in the gl3a.com Breach

• Email Address
• Password Hash

Why a Defunct Website's Data Remains a Live Threat

When a site shuts down, its user database does not disappear. The gl3a.com records are beleived to have been traded across multiple breach aggregation channels since 2020. Users who registered on gl3a.com and reused that password elsewhere have likely never recieved a breach notification, because the site no longer exists to send one, making proactive personal monitoring the only reliable defense.

How Database Breaches Work

A database breach occurs when an unauthorized party extracts records directly from a backend database. Common methods include SQL injection, exploitation of unpatched vulnerabilities, or access via stolen administrative credentials. The extracted data is typically formatted as a dump file and distributed on dark web marketplaces or Telegram channels, where it is purchased and used for credential attacks against other platforms.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion leaked records to check whether your email or password appeared in the gl3a.com breach or any other known incident. Run a free scan at HEROIC today and take action before attackers do.