The MCQforall Breach Gave Hackers MD5 Hashes for 9,983 Accounts

HEROIC analysts identified a database leak from MCQforall, an Indian online education portal that provides practice questions and study materials for competitive exams. The data surfaced on a hacking forum on August 26, 2018, and included 9,983 user records made up of email addresses and MD5 password hashes.

Why This Is Dangerous

MD5 is an outdated hashing algorithm that is fast to crack with modern hardware. That means the password hashes in this leak are not the protection they might appear to be. Anyone who downloads this dataset can run it through widely available cracking tools and recover a large share of the original plaintext passwords, turning a hash dump into a working list of email and password combinations.

What Was Exposed

• Email addresses
• MD5 password hashes

Why This Matters

Once MD5 hashes are cracked, the resulting email and password pairs become fuel for credential stuffing, where attackers test the same combination across email providers, banking sites, and other services. Students and professionals studying for competitive exams often reuse a favorite password across school portals, email, and job sites, which makes a breach like this one a realistic path to account takeover, identity theft, or financial fraud well beyond MCQforall itself.

How This Database Leak Happened

This incident is categorized as a database and combolist leak, meaning the data was pulled directly out of MCQforall's backend, likely through a vulnerability in the website or a compromise of database credentials, and then compiled into a combined list format that is easy to search and reuse. Unlike a stealer log pulled from individual infected devices, this type of breach exposes every account stored in the platform's database at once, which is why the MD5 hashing choice made such a large practical difference in how much risk the leak carries.

Check If You Are Affected

If you have ever used MCQforall or reused a password across multiple accounts, HEROIC's free breach scanner can check your email address against a database of more than 400 billion leaked records, including this one. Run a scan now to see if your information was exposed.