The Grandpa’s Art Breach Put 9,712 Salted Password Hashes Online

Grandpa's Art Data Breach: What HEROIC Analysts Found

HEROIC analysts identified a data breach tied to Grandpa's Art, a US-based ecommerce platform selling art prints and figurines with a focus on African American artists, dated August 26, 2018. The breach exposed 9,712 records containing email addresses along with salted password hashes. The data was later shared on a popular hacking forum, making it accessible to anyone searching for exploitable credentials.

Why This Is Dangerous

Salting a password hash makes it harder to crack than an unsalted one, but it is not unbreakable. Attackers with enough time and computing power can still run these hashes through cracking tools, and any password that is short, common, or reused elsewhere is especially vulnerable. Once cracked, an email and password pair from Grandpa's Art can be tried against other accounts belonging to the same person.

What Was Exposed in the Grandpa's Art Breach

• Email addresses
• Salted password hashes

Why This Matters for Grandpa's Art Customers

Even a salted hash is only as strong as the password behind it. Attackers routinely run leaked hash dumps like this one through cracking software, testing them against lists of common passwords. Any successful crack opens the door to credential stuffing, where the same email and password combination is tried across banking sites, email providers, and other online stores, potentially leading to account takeover or fraud.

How Combolist and Database Breaches Like This Work

This incident follows the typical path of a database breach. Attackers gained direct access to Grandpa's Art's stored user records, likely through a vulnerability in the site or its hosting environment, and copied the account data in bulk. From there, the email addresses and password hashes were packaged into a combolist, a format built so other attackers can feed it into password cracking and automated login tools, and then shared on a hacking forum for wider distribution.

Check If You Are Affected by the Grandpa's Art Breach

If you ever made a purchase through Grandpa's Art, or if you tend to reuse passwords across different sites, it is worth checking your exposure. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, helping you spot compromised accounts and change any passwords that are still in use elsewhere.