How a 2018 Database Leak Exposed 9,452 MatchFlick User Passwords

HEROIC analysts identified a dataset from MatchFlick, a now-defunct U.S. film information and review platform, circulating on a hacking forum. The data was posted on August 26, 2018, and contains 9,452 user records made up of email addresses and MD5 password hashes.

Why This Is Dangerous

MD5 is one of the weakest password hashing methods still found in old databases. Free, widely available cracking tools can turn a large share of MD5 hashes back into readable passwords in a short amount of time. Once an attacker has an email and password pair from MatchFlick, the real threat is not the defunct movie review site itself, it is every other account where that same password might still be in use.

What Was Exposed in the MatchFlick Breach

• Email addresses of registered MatchFlick users
• Passwords stored as MD5 hashes

Why This Matters

Even though MatchFlick shut down years ago, its old user data still carries risk today. Cracked credentials from breaches like this one get folded into combolists that attackers run against email providers, banks, and social media platforms in what is known as credential stuffing. Anyone who reused their MatchFlick password elsewhere faces a real risk of account takeover, identity theft, or financial fraud, even though the original site no longer exists.

How a Database Breach Becomes a Combolist

This incident is classified as both a database breach and a combolist. That means the 9,452 records were first pulled directly from MatchFlick's own database, most likely through a security flaw in the site's backend, and then reformatted into a combolist: a simple file pairing each email with its matching password. Combolists trade freely on hacking forums because they require no special skill to use. An attacker simply loads the list into automated software and lets it try each pair against popular websites.

Check If You Are Affected

If you ever had an account on MatchFlick or reuse passwords across sites, it is worth finding out if your information appears in this breach or any other. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can see your exposure and update any at-risk passwords right away.