Journal of Industrial Pollution Control Data Breach: 36,812 Records Exposed

The Hidden Data Risk in Academic Journal Publishing

Academic journals don't typically appear on lists of high-profile breach victims -- they lack the financial data of banks, the user scale of social networks, or the commercial value of e-commerce platforms. But the Journal of Industrial Pollution Control, a UAE-based science publication covering environmental and industrial research, learned in early 2018 that researchers, reviewers, and reserchers worldwide had trusted them with something just as valuable: their login credentials. 36,812 records were exposed, every password stored in plaintext.

Journal of Industrial Pollution Control (February 2018): Breach Summary

• Records Exposed: 36,812
• Data Types: Email addresses, usernames, passwords (Plaintext)
• Breach Type: Database, Combolist
• Country Affected: United Arab Emirates
• Date Leaked: February 7, 2018

Academic Publishing Platforms as Credential Repositories

The acedemic publishing ecosystem runs on user accounts -- authors submit manuscripts, reviewers log in to evaluate papers, editors manage workflows, and readers access paywalled content. Each of these users registers with an email address and a password, often the same one they use everywhere else. The Journal of Industrial Pollution Control's user base spans environmental engineers, industrial chemists, policy researchers, and academics from institutions across the world. For an attacker, a breach of an academic journal isn't about the journal itself -- it's about harvesting institutional email addresses (.edu, .gov, .org) and their associated passwords for use against higher-value targets.

Plaintext Passwords in a Professional Trust Context

Researchers and academics who publsihed in or reviewed for JIPC did so within a professional trust framework -- they expected the platform to handle their data responsibly. Plaintext password storage is a fundamental violation of that trust. It means no defense between database access and account takeover: no hashing algorithm to reverse-engineer, no salt to calculate around, just the raw password string sitting in a database column. For users who registered with university email addresses and shared that password with institutional systems, the consequences could extend well beyond JIPC itself.

An Early 2018 Disclosure from the UAE's Scientific Community

The February 7, 2018 date makes this one of the earlier breach disclosures in the 2018 combolist wave. UAE-based science publications occupy an interesting position in the global academic ecosystem -- serving authors and reviewers from the Gulf Cooperation Council states, South and Southeast Asia, and Africa, regions where English-language scientific publication opportunities have historically been limited. That geographic spread means JIPC's user base likely includes institutional credentials from a wide range of countries, amplifying the downstream risk beyond the UAE itself.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to tell you exactly which of your accounts have been compromised. If you ever submitted to, reviewed for, or accessed JIPC's platform, run a check now at HEROIC.com -- plaintext passwords from 2018 remain fully usable in today's credential stuffing campaigns.