If You Reuse Passwords, Loja Esoterica Virtual’s Leak Should Worry You

HEROIC analysts identified a dataset from Loja Esoterica Virtual, a now-defunct Brazilian educational and e-commerce platform specializing in theosophy and esotericism, circulating on a hacking forum. Discovered on August 24, 2018, the dataset contains 6,204 records, including email addresses along with a mix of plaintext passwords and salted MD5 password hashes.

Why This Is Dangerous

This breach is worse than most because it combines two failure modes at once. Some passwords were stored as plaintext, meaning they were exposed instantly with no cracking needed. Others were salted MD5 hashes, which take more effort to crack but are still far from unbreakable. Either way, if you ever created an account on this site and reused that password anywhere else, an attacker likely already has what they need.

What Was Exposed in the Loja Esoterica Virtual Breach

• Email addresses
• Plaintext passwords
• Salted MD5 password hashes

Why This Matters for the 6,204 People Affected

If you reuse passwords across accounts, a breach like this one is exactly the kind of leak that leads to credential stuffing, where attackers automatically test stolen email and password pairs against banking, email, and shopping sites. A password from a small esoteric bookstore in Brazil can end up unlocking accounts that have nothing to do with the original site, resulting in account takeover, identity theft, or financial fraud.

How This Database Breach Happened

This incident is classified as a database and combolist breach, meaning attackers obtained a direct copy of the site's user table, likely through a vulnerability in its e-commerce platform, and packaged the emails, plaintext passwords, and hashes for distribution on a hacking forum. The mix of plaintext and hashed passwords suggests the site may have been transitioning its security practices when the breach occurred, leaving older accounts fully exposed.

Check If You Are Affected

To find out if your email address or password appears in this leak or any other, run a free scan with HEROIC's breach checker, which searches a database of more than 400 billion leaked records.