The Hudson-Poole Breach: 18,579 Records, More Than a Sold-Out Arena

HEROIC analysts identified a dataset from Hudson-Poole Fine Jewelers, a jewelry retailer based in Tuscaloosa, Alabama, that was breached on August 26, 2018. The incident exposed 18,579 records containing email addresses and MD5-hashed passwords, which were later posted on a hacking forum.

Why the Hudson-Poole Breach Is Dangerous

MD5 is an older hashing method that modern cracking tools can break through in bulk, especially for passwords that are short or commonly reused. Once an attacker recovers the original password from the hash, they pair it with the matching email address and have a ready-to-use login for any account where that password was reused.

What Was Exposed

• Email addresses
• MD5 password hashes

Why This Matters

Shoppers who created an account with a jewelry retailer often reuse the same password on shopping, banking, or email accounts elsewhere. Cracked credentials from this breach can be used for credential stuffing, testing the same login across other services until one works. That single match can lead to account takeover, financial fraud, or identity theft that has nothing to do with the original jewelry store.

How Database and Combolist Breaches Like This Happen

This breach traces back to a direct compromise of Hudson-Poole's customer database, most likely through a vulnerability in the retailer's website or login system. Once attackers copied the table of emails and password hashes, they packaged the data into a combolist, a compiled file built for easy reuse and resale on hacking forums. Combolists like this one continue to circulate for years after the original breach, which is why 2018 data is still worth checking today.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this Hudson-Poole Fine Jewelers breach. Run a scan now, and change any password you may still be reusing from 2018.