Medical Device Authority Malaysia Leak Exposed 4,229 Password Hashes

HEROIC analysts identified a database leak tied to the Medical Device Authority Malaysia, a regulatory body under Malaysia's Ministry of Health that oversees medical device registration, safety, and licensing. The data surfaced on a hacking forum on August 26, 2018, exposing 4,229 records made up of email addresses and MD5 password hashes.

Why This Is Dangerous

MD5 is an outdated hashing algorithm that modern hardware can crack quickly. That means the password hashes in this leak are far less protective than they look on paper. Anyone with this dataset can run it through freely available cracking tools and recover a meaningful share of the original plaintext passwords, turning a list of hashes into working login credentials.

What Was Exposed

• Email addresses
• MD5 password hashes

Why This Matters

Once cracked, an email and password pair from a government portal like this one rarely stays contained to a single account. If the same password was reused for a personal email account or another online service, a single cracked hash can chain into access across multiple accounts, opening the door to credential stuffing, account takeover, identity theft, and financial fraud far beyond the original portal.

How This Database Leak Happened

This incident is classified as a database and combolist leak, meaning the data was pulled directly from the Medical Device Authority Malaysia's backend systems and compiled into a list format that is easy to search and reuse. Unlike a stealer log taken from individual infected devices, a database leak like this one exposes every account stored on the platform at once, which is why the choice of MD5 hashing had such a large impact on how exploitable the leaked data became.

Check If You Are Affected

If you have ever used a Medical Device Authority Malaysia account or reused a password across other services, HEROIC's free breach scanner can check your email address against a database of more than 400 billion leaked records, including this one. Run a scan now to see if your information was exposed.