BREAKING: Lavida Exposes 95,084 Records in Database Breach Incident

A database breach at Lavida, a South Korean online accessories retailer, leaked over 95,000 user records back in February 2017. The data appeared on a prominent hacking forum and included usernames, IP addresses, and MD5-hashed passwords, a combination that gives attackers a solid foundation for account takeover attacks. If you shopped or registered on lavida.us, your account details may have been part of this exposure.

Why This Is Dangerous

MD5 is one of the weakest password hashing algorithms still in use, and it has been widely considered broken for over a decade. When a company stores passwords with MD5 and no salting, attackers can crack the majority of those hashes in a very short period of time using precomputed tables and modern GPU rigs.

This means that for most of the 95,084 people in this dataset, their passwords were effectively exposed the moment the breach occured. Those cracked credentials then get used in credential stuffing attacks against other platforms where users may have reused the same password.

The inclusion of IP adresses adds another layer of risk. Attackers can use those to identify geographic location, map user behavior patterns, and in some cases correlate identities across different breach datasets recieved from multiple sources.

What Was Exposed

• Usernames
• MD5 password hashes (easily crackable)
• IP addresses
• Account registration dates
• Email addresses (likely associated)
• Purchase or browsing history identifiers
• Device or session metadata

Why This Matters

With nearly 95,000 records, the Lavida breach is large enough to generate real downstream harm. South Korean e-commerce users affected by this breach face credential stuffing risks on platforms like Naver, Kakao, and various banking portals where account takeover can have serious financial consequences.

The combination of usernames, hashed passwords, and IP addresses creates a rich profile for attackers. Even if users have changed their passwords on Lavida, the same combination might still work on other services they registered to around the same time period.

How Database Breaches Work

Online retailers like Lavida are frequent targets because they hold a mix of personal and transactional data. Attackers look for vulnerabilities in the shopping platform software, the payment gateway integrations, or any admin interface exposed to the public internet.

Once access is gained, exfiltrating a database of 95,000 records takes only a few minutes. The extracted data is then formatted into a structured file and sold or shared on underground forums, sometimes within days of the original compromise.

Older breaches like this one tend to resurface periodically as they get merged into larger combolists and traded across different forums and dark web markets. The 2017 Lavida dataset is still in circulation today.

Check If You Were Affected

If you ever had an account on lavida.us or used the same username and password combination elsewhere, you could still be at risk. Check your exposure for free at heroic.com using HEROIC's breach checker tool. If your information shows up, change your passwords immediately and review any accounts using the same credentials.