19,031 Hashed Passwords From the Licenses 4 Work Breach Are Still Circulating

Over 19,000 records from Licenses 4 Work, an Australian vocational training organization, were recieved by HEROIC analysts during routine dark web monitoring in August 2018. The breach exposed email addresses, password hashes, and cryptographic salts. What makes this incident notable is the mixed password storage approach: some records used bcrypt while others relied on MD5 with salting, indicating inconsistent security practices across the platform's user database. The data has circulated in breach aggregation services and Telegram channels since its initial exposure.

Mixed Hashing Algorithms: When bcrypt and Weak MD5 Coexist

When a breach contains both bcrypt and MD5-salted hashes, attackers prioritize the MD5 records first because they are significantly easier to crack despite the added salt. Once those passwords are recovered, they are tested against other platforms in credential stuffing attacks. The presence of bcrypt records does not protect the users whose accounts were stored with MD5, and seperate cracking strategies mean attackers work through both sets systematically. Vocational training platforms often serve workers with access to employer systems, making their compromised credentials particularly valuable.

What Was Exposed in the Licenses 4 Work Breach

• Email Address
• Password Hash
• Salt

Why Vocational Training Breaches Create Workplace Security Risks

Licenses 4 Work serves workers obtaining accredited qualifications for employment in regulated industries. Those users frequently register with their work email addresses, meaning a breach of this training platform can expose credentials that are accessable pathways into employer networks. Credential stuffing attacks using recovered passwords may yield access to workplace portals, HR systems, or government licensing databases. Financial fraud and identity theft are compounded when attackers combine email access with knowledge of the victim's professional certifications and employment context.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a web application's data storage layer and extracts user records. This is commonly achieved through SQL injection attacks, exploitation of unpatched software vulnerabilities, or access via stolen administrative credentials. The extracted database is then packaged as a dump file and distributed through underground marketplaces or directly traded between criminal groups. For Licenses 4 Work, the extracted data included user registration fields with email addresses, hashed passwords, and the salt values used in the hashing process.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion compromised records, including the Licenses 4 Work breach. Visit HEROIC.com to run a free scan and discover instantly whether your credentials have been exposed in this or any other known data breach.