Inside the MnGeo Breach: How 8,577 Records Were Compromised

In August 2018, a dataset tied to the Minnesota Geospatial Information Office, known as MnGeo, appeared on a hacking forum. MnGeo is the state agency responsible for coordinating GIS data, maps, and geospatial services for Minnesota, and the breach exposed 8,577 user accounts, including email addresses and password hashes protected with the SHA-1 algorithm.

Why This Is Dangerous

MnGeo's user base likely includes state employees, GIS professionals, contractors, and researchers who registered with work-related email addresses and may have reused passwords tied to other government or professional systems. SHA-1 was already considered an outdated and inadequate hashing algorithm by 2018, and hashes created with it can often be cracked relatively quickly using modern hardware and precomputed lookup tables. That combination of work-affiliated accounts and weak password hashing makes this breach more consequential than its record count alone might suggest.

What Was Exposed

• Email Addresses
• Password Hashes (SHA-1)

Why This Matters

A breach tied to a government agency carries risks beyond the individuals directly affected. If a state employee or contractor reused a work-related password on the MnGeo platform, that same credential could potentially unlock other government or professional accounts once the SHA-1 hash is cracked. Smaller public sector agencies like MnGeo often have fewer cybersecurity resources than larger federal counterparts, which can make them easier targets and, in some cases, a way for an attacker to gain a foothold connected to broader state systems.

How Database Breaches Work

Government websites, particularly older or custom-built portals, are frequently targeted through SQL injection attacks or the exploitation of unpatched vulnerabilities. An attacker who finds a flaw in a site like MnGeo's can extract the entire user table, including hashed passwords, without needing to log in as a legitimate user. Once extracted, the data is typically converted into a combolist and shared or sold on hacking forums, and SHA-1 hashes recovered this way are often run through cracking tools to try to reveal the original passwords, since the algorithm was not designed to resist that kind of attack at scale.

Check If You Are Affected

If you ever registered for access to MnGeo's geospatial data portal or a related Minnesota state platform, your credentials may have been exposed in this breach. Run a free search at heroic.com, which checks your email address against more than 400 billion records from confirmed breaches. If you used the same password on government, workplace, or personal accounts, change it everywhere and enable multi-factor authentication where it is available.