The GPG Industries Leak Exposed 22,496 Chinese Electronics Accounts Back in 2018

In August 2018, data from GPG Industries, a Chinese company specializing in electronics, cables, connectors, and hardware accessories, appeared on underground sources. The breach exposed 22,496 accounts containing email addresses and MD5 password hashes. Although the company has since shut down, the data did not disappear with it. It was absorbed into combolists and continues to circulate on underground forums today, where attackers routinely test the recovered credentials against active platforms. For Chinese users who registered with GPG Industries and reused those credentials elsewhere, the exposure remains live.

Why This Is Dangerous

MD5 is a discredited hashing algorithm. Despite its widesspread use in early-generation websites, it provides no real protection against modern cracking. Tools like Hashcat running on consumer-grade GPUs can test billions of MD5 combinations per second, meaning the majority of passwords in this breach were likely recoverd within hours of the dump appearing on underground sources. Once cracked, those passwords become live credentials for any other service where the same email and password combination was used. Chinese users who registered on platforms with the same password pattern face ongoing risk from credential stuffing attacks.

What Was Exposed

• 22,496 total user records exposed
• Email addresses used for account registration
• MD5 password hashes (highly susceptible to cracking)
• Breach date: August 26, 2018
• Industry: Electronics, cables, connectors, hardware
• Country of origin: China
• Distribution: Underground forums, combolists

Why This Matters

Breaches from defunct companies present a particular challange for affected users: there is no company left to notify them, no breach disclosure, and no password reset prompt. Affected GPG Industries users likely never received any warning that their data was exposed. In the years since August 2018, the data has been integrated into aggregated combolists and tested against major platforms. Users who registered on GPG Industries' shop portal with email addresses tied to their primary accounts face a credible and ongoing risk of unauthorized access across multiple services.

How Combolists Extend Breach Damage

A combolist is a compiled file of email-password pairs drawn from multiple breaches. When a site like GPG Industries is breached and password hashes are cracked, the resulting pairs are added to these aggregated lists. Those lists are then distributed broadly and used in automated credential stuffing tools that test logins across thousands of websites simultaneously. The GPG Industries breach, small on its own, becomes one input in a much larger attack infrastructure. Because the company is defunct, the data never expires from a threat actor's perspective -- it remains valid wherever password reuse exists.

Check If You Are Affected

HEROIC's free scanner checks your email against 400 billion+ compromised records, including the GPG Industries breach and the combolists it has contributed to. If your email appeared in this dump or any derived credential list, you will see a full exposure report immediately. Run a free check now to know exactly where your data has been found.