IEPS Data Breach Exposes Password Hashes: Check If You Are Affected

HEROIC analysts reported a leak tied to IEPS, held together with salted MD5 password hashes, a storage method that slows attackers down but does not stop them. Dated August 1, 2023, the file reportedly pairs 90 records of email addresses with those hashes. The only way to know if you are affected is to scan your email.

Why A Cracked Hash Still Opens Doors

A salted MD5 hash is not plain text, but it is not a vault either. With enough computing time, common passwords hidden behind this method get guessed and reversed, especially when the original password was short, reused, or based on a dictionary word. Once an attacker has a working email and password pair, they do not need to stop at the one site the pair came from.

The Two Fields In This File

• Email Address: gives an attacker a confirmed, working address to target with follow up messages.
• Password Hash: if cracked, hands over the actual password tied to that address.

The Real Risk Behind This Pair Of Fields

Email and password pairs are the building blocks of account takeover. If the password underneath that hash gets cracked and it was reused anywhere else, an attacker can walk straight into other logins without tripping any alarm. Even without a successful crack, a confirmed working email address is enough to build a convincing, targeted phishing message.

How Records Like This Get Out

This is listed as a database incident, meaning the records were taken from the service's own systems rather than pulled off an individual's device. Once copied, that data tends to spread further over time, with each new copy landing in more hands than the last.

What Should You Do If Your Email Turns Up Here?

Start by running a scan your email check to see whether your address is tied to this particular leak. If it is, and you have ever reused that same password on another site, change it there first since that is the password an attacker is most likely to try next. Set a unique password for each login going forward so one weak hash from one incident cannot unlock the rest of your accounts. This advice holds whether the address in question is a personal inbox or a work one.