Inside the Mebo TCM Leak: How 3,648 MD5 Hashes Got Exposed

HEROIC analysts identified a database leak tied to Mebo TCM, a now-defunct Chinese medical information website focused on acupuncture study. The data surfaced on a hacking forum on August 26, 2018, exposing 3,648 records made up of email addresses and MD5 password hashes.

Why This Is Dangerous

MD5 is a fast, outdated hashing algorithm that modern computers can crack in bulk. A password hash that looks secure on paper can often be reversed into its original plaintext password within seconds using freely available tools, which means the protection MD5 offers here is largely an illusion.

What Was Exposed

• Email addresses
• MD5 password hashes

Why This Matters

Once an attacker cracks an MD5 hash from a leak like this one, they have a working email and password pair that can be tried against other accounts, a technique known as credential stuffing. Even with only 3,648 records involved, anyone who reused their Mebo TCM password on an email account or elsewhere remains exposed to account takeover, identity theft, or financial fraud.

How a Database and Combolist Leak Works

This incident is classified as a database and combolist leak, meaning attackers pulled the data directly from Mebo TCM's backend, likely through a vulnerability in the site's code or a compromise of its database credentials, then compiled the records into a combolist, a simple format of email and password pairs that is easy to search and reuse. Once the passwords are cracked from their MD5 hashes, a combolist like this becomes an off the shelf tool for automated login attempts across other websites.

Check If You Are Affected

If you ever registered on Mebo TCM or reused a password across multiple accounts, HEROIC's free breach scanner can check your email address against a database of more than 400 billion leaked records, including this one. Run a scan now to see if your information was exposed.