Researchers Link HPI Racing Limited Breach to 5,936 Stolen Logins

HEROIC analysts identified a dataset tied to HPI Racing Limited, the UK arm of the RC vehicle manufacturer, circulating on a hacking forum dated August 21, 2018. The breach affected 5,936 users in the United Kingdom, exposing email addresses paired with password hashes stored in an unconfirmed format. The dataset has continued to surface on forums years after the original theft, keeping it in active circulation among criminals.

Why the HPI Racing Limited Breach Is Dangerous

Password hashes are meant to protect the original password, but weaker hashing methods can be cracked with brute-force tools and precomputed rainbow tables. Once cracked, a hash becomes a working password again, and paired with its matching email address, it gives an attacker a direct route into the account it was meant to protect.

What the HPI Racing Limited Breach Exposed

• Email addresses
• Password hashes

Why This Matters

Cracked credentials from a breach like this fuel credential stuffing, where attackers try the same email and password across banking, email, and shopping accounts. For the 5,936 people affected, that risk means potential account takeover, financial fraud, or identity theft on services that have nothing to do with HPI Racing Limited itself.

How a Database and Combolist Breach Like HPI Racing Happens

This incident is classified as a database and combolist breach, meaning an attacker gained direct access to the company's user database, likely through a software vulnerability or a compromised administrative account. The stolen email addresses and password hashes were compiled into a combolist and shared on hacking forums, where they remain available for anyone looking to run automated login attempts against other sites.

Check If You Are Affected

If you ever created an account with HPI Racing Limited, change that password now, along with any other account where you used the same one, and turn on multi-factor authentication wherever it is offered. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this one, so you can quickly find out if your information was exposed.