The Meduso Leak Exposed 9,384 Lithuanian E-Certificate Accounts

HEROIC analysts found a database breach tied to Meduso, a Lithuanian site that issued e-certificates for education and health purposes, posted on a prominent hacking forum. The data is dated August 26, 2018, and includes 9,384 records made up of email addresses and plaintext passwords.

Why This Is Dangerous

Unlike hashed or encrypted passwords, plaintext means the password is stored and shared exactly as the user typed it. There is no cracking required, whoever has this file can read every password directly and try it immediately on the account it belongs to, and on any other account that might share it.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Because these passwords are already in plain, readable form, they are especially valuable for credential stuffing, the automated process of trying stolen email and password pairs across banking, email, and other accounts. Anyone who reused their Meduso password anywhere else faces a heightened risk of account takeover, financial fraud, or identity theft, even years after the original breach.

How Database Breaches Become Combolists

A breach like this typically happens when attackers exploit a flaw in a website's database or server configuration and pull out user records directly. Because the passwords here were already stored in plaintext, no cracking step was needed before this data could be folded into combolists, the email and password lists that circulate on hacking forums and get reused in attacks for years after the initial leak.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including breaches like this one. If your information turns up, changing that password anywhere you have used it is the fastest way to reduce your risk.