The Mahindra Ecole Centrale Leak Contains Exactly 13,122 Pairs

HEROIC analysts found a database breach tied to Mahindra Ecole Centrale, a now-defunct Indian educational institution's website, circulating on a prominent hacking forum. The data is dated August 26, 2018, and contains exactly 13,122 records made up of email addresses and plaintext passwords.

Why This Is Dangerous

Because the passwords in this breach were stored in plaintext rather than hashed or encrypted, they are exactly as usable today as they were the day they were stolen. There is no cracking step standing between an attacker and a working login, only the question of whether the person reused that password anywhere else.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

A precise, ready-to-use set of 13,122 email and password pairs is exactly what attackers look for when building credential stuffing lists, tools that automatically test stolen logins against email, banking, and shopping sites. Even though Mahindra Ecole Centrale is no longer operating, anyone who reused their password from this account elsewhere still faces a risk of account takeover, financial fraud, or identity theft.

How Database Breaches Become Combolists

This kind of breach usually starts with attackers finding a way into a website's database, often through an unpatched vulnerability, and extracting user records wholesale. Since the passwords here were already stored in plaintext, they required no additional cracking before being merged into combolists, the credential lists that get traded and reused on hacking forums for years, long after the original site has gone offline.

Check If You Are Affected

HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including older breaches like this one from a defunct site. If you find a match, changing that password anywhere else you used it is the quickest way to stay safe.