The House-Store Leak Contains More Customer Records Than Most Small Towns Have Residents

A database belonging to House-Store, a French-language ecommerce platform selling home furnishings, was leaked on breach forums in June 2022. The exposed data contained 3,807 unique customer records including email addresses, full names, birthdays, IP addresses, and MD5 hashed passwords. Though the record count is small, the data types combined make each entry a seperate threat vector for identity fraud and credential reuse attacks.

What Attackers Can Do With MD5 Password Hashes and PII

MD5 is a deprecated hashing algorithm that can be cracked within seconds using widely accessable rainbow table lookups and GPU-accelerated tools. Once cracked, the recovered passwords can be combined with the leaked email addresses, full names, and birthdays to launch credential stuffing attacks against banking, shopping, and email platforms frequented by the same users.

What Was Exposed in the House-Store Breach

• Email Address
• Password Hash (MD5)
• First Name
• Last Name
• IP Address
• Birthday

Why the House-Store Leak Is a Bigger Risk Than Its Size Suggests

Small breaches are routinely merged into large aggregated credential lists that power industrial-scale stuffing operations. The House-Store dataset, with its full name and birthday fields alongside crackable MD5 hashes, provides the kind of identity depth that attackers use to pass knowledge-based authentication challenges and reset account passwords on behalf of victims.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a backend data store, often through SQL injection vulnerabilities, exposed administrative interfaces, or compromised credentials. Ecommerce platforms running outdated software or lacking a web application firewall are particularly susceptible. Attackers extract and sell or publish the raw database tables, which then circulate across hacker forums and breach aggregation sites.

Check If Your Data Was Exposed

HEROIC monitors over 400 billion exposed records across thousands of known breaches, including the House-Store leak. Search your email address now to see whether your personal data is circulating on the dark web, and get alerted to future exposures before criminals can act on them.