The If Music Breach Contains Exactly 5,492 Email and Password Pairs

HEROIC analysts identified a dataset from If Music, a London-based record shop and online retailer specializing in vinyl and rare music formats, that was breached on August 26, 2018. The incident exposed 5,492 records containing email addresses and salted MD5 password hashes, later posted on a hacking forum.

Why the If Music Breach Is Dangerous

Salting makes these password hashes harder to crack in bulk than unsalted MD5, since attackers cannot rely on precomputed rainbow tables. But each password can still be attacked individually, and any password that was short or common can be recovered with enough computing time. Once cracked, that password is paired directly with a real email address and ready to use elsewhere.

What Was Exposed

• Email addresses
• Salted MD5 password hashes

Why This Matters

Anyone who shopped at If Music and reused that password on another account is at risk if their specific password gets cracked. Attackers use recovered credentials for credential stuffing, testing the same email and password combination against banking, email, and other shopping accounts. That single match can open the door to account takeover, financial fraud, or identity theft far removed from a niche record shop.

How Database and Combolist Breaches Like This Happen

This breach traces back to a direct compromise of If Music's customer database, most likely through a vulnerability in the retailer's website or login system. Once attackers copied the table of emails and password hashes, they packaged the data into a combolist, a compiled file designed for easy reuse and resale on hacking forums. Combolists like this one keep circulating for years after the original breach.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this If Music breach. Run a scan now, and change any password you may still be reusing from 2018.