Researchers Trace the Intimshop Breach to 126K Exposed Russian Users

HEROIC analysts recieved intelligence pointing to a dark web database dump tied to Intimshop, a Russian e-commerce retailer operating at intimshop.ru. The breach occured on September 14, 2022, and exposed 126,877 user records pulled directly from the platform's backend database. The leaked dataset includes email addresses, MD5 password hashes, usernames, IP addresses, birthdays, and gender details, covering a wide range of personally identifiable information from a platform operating in the Russian Federation.

Why MD5 Password Hashes Put Intimshop Users at Immediate Risk

MD5 is a broken hashing algorithm, and attackers with accessable cracking tools can reverse MD5 hashes into plaintext passwords within hours using modern GPU rigs and rainbow tables. With plaintext passwords in hand, threat actors can launch credential stuffing attacks against email providers, banking apps, and other services where users reused the same password. The combination of email address plus cracked password is partcularly dangerous because it unlocks accounts far beyond the original breach site.

What Was Exposed in the Intimshop Breach

• Email Address
• Password Hash (MD5)
• Username
• IP Address
• Birthday
• Gender

How Birthdates and Gender Data Amplify Identity Theft Risk

Breaches that combine email addresses, passwords, birthdates, and gender details give criminals everything they need to build convincing identity profiles. Fraudsters use this combination for account recovery bypasses, targeted phishing emails tailored to the victim's demographics, and in some cases, full synthetic identity fraud. The IP addresses in this dataset also reveal the approximate physical locations of affected users, making it easier to craft region-specific social engineering attacks. These are real-world consequences that beleive or not extend well beyond the original platform.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to a backend data store, typically by exploiting SQL injection vulnerabilities, weak administrative credentials, or misconfigured database servers exposed to the public internet. Once inside, attackers export user tables containing all stored records. In many cases the breach is silent: the platform continues operating normally while the stolen data is quietly sold or published on underground forums. Victims have no indication their information has been taken until it surfaces in a credential dump or is used in a follow-on attack.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records, including datasets like the Intimshop dump, to tell you instantly whether your email address appears in known breaches. If your credentials were exposed, you will know exactly what data was leaked and what steps to take next. Run a free scan at HEROIC.com to find out if your information is at risk.