The MBIK Leak Exposed 16,283 Hungarian Plaintext Passwords

HEROIC analysts identified a dataset from MBIK (Magyar Bútoripari Innovációs Központ Zrt.), a Hungarian furniture industry innovation center based in Budapest, circulating on a hacking forum. The data was posted on August 26, 2018, and contains 16,283 user records made up of email addresses and passwords stored in plaintext.

Why This Is Dangerous

Plaintext passwords are the worst-case scenario in any breach. There is no hashing or encryption standing between the leaked file and a working login. Anyone who downloads this dataset can read every password exactly as it was typed and use it immediately, no cracking tools required.

What Was Exposed in the MBIK Breach

• Email addresses of registered MBIK users in Hungary
• Passwords stored in plaintext, with no encryption at all

Why This Matters

MBIK serves as an innovation and training hub for Hungary's furniture industry, meaning many of the 16,283 affected users are likely professionals who reuse the same login across work and personal accounts. If a password from this breach matches one used elsewhere, an attacker can use it for credential stuffing, leading to account takeover, identity theft, or financial fraud against people who may have no idea their information was ever exposed.

How This Database Breach Became a Combolist

This incident is classified as both a database breach and a combolist. The 16,283 records were taken directly from MBIK's own database, likely through a flaw in how the site stored user accounts, and then repackaged into a combolist, a simple file pairing each email with its matching password. Because the passwords are already in plaintext, this combolist requires no extra cracking work, making it especially easy for attackers to put to immediate use.

Check If You Are Affected

If you have ever registered with MBIK or reuse passwords across different sites, it is worth checking your exposure. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to show you instantly whether your email address appears in this breach or any other.