How the Hemporium Database Breach Led to 34,444 Stolen Logins

In June 2022, Hemporium, an Italian e-commerce platform for cannabis products, suffered a database breach that exposed over 34,000 user records. The compromised data was recieved by criminal markets where it was bundled with other breach datasets and used to fuel credential stuffing campaigns. With MD5-hashed passwords, full names, birthdays, and gender all leaked together, the impact on affected users extends well beyond a simple password reset.

How MD5 Passwords Make the Hemporium Breach Especially Dangerous

MD5 is a weak hashing algorithm that was depreciated for security use years ago. Attackers with GPU-powered cracking tools can reverse millions of MD5 hashes per second using precomputed rainbow tables. Once cracked, each password becomes a working credential that gets tested against email inboxes, banking apps, and social media accounts. Gender and birthday data from this breach makes the subsequent phishing attempts far more convincing and targeted.

What Was Exposed in the Hemporium Breach

• Email Address
• Password Hash (MD5)
• First Name
• Last Name
• IP Address
• Gender
• Birthday

Why the Hemporium Leak Puts You at Ongoing Risk

Breach data from 2022 is still actively traded and used today. Attackers combine multiple datasets to build complete profiles, and the personal details exposed here, including birthdays, genders, and full names, give them enough context to impersonate victims in social engineering attacks. This type of profile data is particularly valuable because it helps criminals pass identity verification checks at financial institutions and phone carriers.

How a Database Breach Works

A database breach happens when an attacker gains unauthorized access to the backend system storing user data. Common entry points include SQL injection vulnerabilities, exposed credentials in code repositories, or compromised administrator accounts. Once inside, the attacker runs a database export command that pulls every user record at once. The resulting file, often containing hundreds of thousands of rows, is compressed and moved to external servers before the platform is even aware of the intrusion.

Check If Your Data Was Exposed

HEROIC's Dark Watch monitors over 400 billion leaked records, including data from the Hemporium breach. Search your email now to find out if your personal data is circulating on the dark web, and activate monitoring to get instant alerts when your information surfaces in new leaks.