The GramLove Breach: 13,437 MD5 Password Hashes Exposed

GramLove Data Breach: What HEROIC Analysts Found

HEROIC analysts identified a data breach tied to GramLove, a now defunct third-party Instagram search tool and photo viewer, dated July 12, 2018. The breach exposed 13,437 unique records containing email addresses and MD5 hashed passwords. The stolen data was later posted on a popular hacking forum, where it remains available to anyone looking for exploitable login credentials.

Why This Is Dangerous

MD5 is a fast, outdated hashing algorithm that modern hardware can crack quickly using rainbow tables and brute force tools. Even though GramLove itself no longer exists, anyone who obtains this dataset can crack a significant share of these hashes back into readable passwords and try them against the associated email addresses on other, still-active services.

What Was Exposed in the GramLove Breach

• Email addresses
• MD5 hashed passwords

Why This Matters Even Though GramLove Is Shut Down

A defunct service does not make its old data harmless. People who signed up for a third-party tool like GramLove often used the same email and password combination they use everywhere else. Once those passwords are cracked, attackers can attempt credential stuffing against email providers, social media accounts, and other online services, leading to account takeover or further identity exposure.

How Combolist and Database Breaches Like This Work

This breach follows a common pattern for smaller third-party apps. Attackers gained direct access to GramLove's user database, likely through a security flaw in the tool itself, and extracted the stored email addresses and MD5 password hashes in bulk. That data was then packaged into a combolist, a simple file pairing emails with passwords, so other attackers could crack the hashes and reuse the resulting credentials in automated login attempts across other platforms.

Check If You Are Affected by the GramLove Breach

If you ever used GramLove to browse Instagram content, or if you reuse passwords across different accounts, it is worth checking your exposure. HEROIC's free breach scanner searches a database of more than 400 billion leaked records so you can see where your information has surfaced and update any passwords still in use elsewhere.