iLoveRead Data Breach: 23,934 Indian Library Records Exposed (2018)

India's Book Delivery Service and the Credentials It Left in a Combolist

iLoveRead offered an unusual service for its time: a home-delivery physical libary in India, bringing books directly to subcribers' doors. The platform's 23,934 users trusted it with their email addresses and passwords in 2018. When those credentials appeared on underground hacking forums in August of that year, the SHA1-hashed passwords became a target for cracking campaigns that have continued to run against this dataset for years -- because SHA1, while slower to crack than MD5, is well within the capabilities of modern GPU-accelerated cracking tools and has been officially deprecated as a password hashing algorithm since at least 2013.

iLoveRead (August 2018): Breach Summary

• Records Exposed: 23,934
• Data Types: Email addresses, SHA1 password hashes
• Breach Type: Database dump / Combolist
• Country Affected: India
• Date Leaked: August 26, 2018

SHA1: Deprecated but Still Dangerous

SHA1 without salting is vulnerable to rainbow table attacks, and salted SHA1 remains feasible to crack via GPU-accelerated brute force. The National Institute of Standards and Technology (NIST) deprecated SHA1 for most applications by 2011, meaning iLoveRead was using a known-weak hashing scheme even in 2018. While SHA1 provides more resistance than raw MD5, it falls far short of bcrypt, scrypt, or Argon2, which are designed specifically for password hashing with built-in work factors. The avalable cracking tools for SHA1 include Hashcat with dedicated SHA1 attack modes, meaning a motivated attacker with adequate hardware can systematically recover passwords from this dataset in a time frame measured in days to weeks rather than years.

Reading Habits, Indian Email Addresses, and Credential Reuse

Users of subscription-based services like iLoveRead often share their primary email addresses -- the same ones they use for banking, work, and social platforms. Indian email addresses from this breach are valuable for credential stuffing campaigns targeting Indian e-commerce platforms, UPI payment systems, and professional networks like LinkedIn, where the same email-password combinations are frequently reused. The library subscription model also means these users actively managed recurring payments, suggesting a higher-than-average likelihood of active banking credentials reused across platforms.

Part of the August 26, 2018 Global Combolist Release

The iLoveRead database appeared alongside more than ten other platforms on August 26, 2018 -- a mass release spanning India, Germany, Thailand, the United States, Italy, Ireland, Japan, Nepal, Poland, and the Netherlands. India's contribution to that day's credential harvest came via an unusual consumer service: a physical book delivery subscription whose digital records ended up in the same underground combolist ecosystem as breaches from financial platforms, sports clubs, and scientific journals worldwide.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including Indian consumer service databases like iLoveRead. If you've used subscription-based services in India, your primary email and password may be in circulation. A scan takes seconds and can flag whether your credentials are active in attack pipelines targeting Indian platforms.