Inside the JD.com Database: How SHA-1 Let 77M Passwords Get Cracked

JD.com, also known as Jingdong Mall, is one of China's largest e-commerce platforms and a direct competitor to Alibaba's Tmall. In 2013, JD.com's database was breached, exposing 77,426,916 user accounts. The stolen records include email addresses, phone numbers, first names, usernames, and SHA-1 password hashes. The breach is classified as unverified due to challenges in confirming Chinese breaches, but the data has been posted on hacking forums and observed in underground markets where it has been repackaged and resold over the subsequent decade.

Why JD Mall Breach Is Dangerous

SHA-1 was already being phased out as a password hashing algorithm in 2013 because of its known vulnerabilities. A database of 77 million SHA-1 password hashes is not a collection of secure credentials. It is a collection of passwords waiting to be cracked. Modern cracking hardware can process SHA-1 hashes at extremely high speeds, and large portions of SHA-1 databases have been successfully reversed using rainbow table lookups and brute force. The additonal fields, phone number and real name, make each cracked record far more useful because they enable targeted phishing and account recovery attacks.

What Was Exposed in the JD Mall Leak

• Email Address
• Phone Number
• First Name
• Username
• SHA-1 Password Hash

Why This JD Mall Data Puts You at Risk

If you shopped on JD.com in 2013 or earlier, your phone number, real name, email, and hashed password are likely in this dataset. Phone numbers from Chinese e-commerce accounts are frequently used in SIM-swapping attacks, where attackers convince carriers to transfer a number to a device they control, bypassing SMS-based two-factor authentication. Combined with the cracked password, a threat actor can use the phone number, name, and email together to reset account access on financial platforms, email services, and other sites where this person has an account.

How SHA-1 Database Breaches Get Cracked and Exploited

SHA-1 was a relativly fast hashing algorithm compared to the purpose-built slow algorithms recommended for password storage. Its speed is exactly what makes it dangerous: attackers can run millions of cracking attempts per second against SHA-1 hashes. The JD.com breach occured in 2013 and has been circulating in underground markets since then. Reports of cracked password lists derived from this breach have appeared in forums where attackers share results of their cracking sessions. Once cracked, the email-password pairs enter the broader credential stuffing ecosystem and are tested against platforms globally, not just in China.

Check If Your Data Was Exposed

HEROIC's free breach search checks your email against 400 billion+ compromised records, including the JD.com dataset. Search now to see if your account was part of this breach. If you used JD.com before 2014 and have not changed the password you registered with since then, update it immediately and enable two-factor authentication on any account using that email address.