How the Melbar Database Breach Exposed 20,932 Shoppers

HEROIC analysts found a database dump linked to Melbar published on a prominent hacking forum on August 21, 2018. Melbar is a German online shop specializing in medieval and historical goods, LARP equipment, costumes, wooden tableware, and historical weapons. The breach affected 20,932 users and the exposed records contained email addresses alongside plaintext passwords, meaning every password in the database was readable without any cracking tools. For a shopping site that collected user accounts, the failure to hash passwords turned a database breach into an immediat credential giveaway.

Why This Is Dangerous

Plaintext passwords are the worst possible outcome in a database breach. When passwords are properly protected, attackers still face time-consuming cracking work before they can use stolen credentials. With Melbar, that barrier did not exist. Every one of the 20,932 email-and-password pairs was ready to use the moment the file was downloaded. Attackers could begin testing those credentials against email providers, payment services, and social media platforms within minutes of obtaining the dataset.

What Was Exposed

• Email Addresses
• Plaintext Passwords

Why This Matters

Password reuse is extremely common, and a shopping site like Melbar is exactly the kind of place where someone might use the same password they use for their primary email or online banking. Credential stuffing attacks take breached lists like this one and automaticaly test each pair across dozens of popular services. Account takeovers follow for any service where the credentials match. Beyond direct account access, attackers can use compromised email accounts to reset passwords on financial accounts, enabling identity theft and fraud. The long shelf life of these credentials means the risk does not expire, datasets from 2018 are still being actively tested today.

How the Melbar Breach Happened

Database breaches at e-commerce sites typically follow one of several paths: SQL injection attacks that extract data through vulnerable web forms, compromise of admin or hosting credentials through phishing, or exploitation of unpatched software vulnerabilities in the store's platform. The Melbar breach resulted in a full database dump ending up on a hacking forum, which indicates the attacker was able to export the entire user table directly. The fact that passwords were stored as plaintext suggests the site did not implement even basic security standards like bcrypt or SHA hashing with salts. Once the data was posted to the forum, it became accessiblle to a broad community of criminal actors, dramatically increasing the exposure risk for affected users.

Check If You Are Affected

HEROIC's free breach scanner covers more than 400 billion exposed records, including the Melbar dataset and thousands of similar database breaches. If you ever created an account on Melbar or used the same email and password combination on other sites, your credentials may already be in circulation on criminal marketplaces. Search your email address for free at HEROIC to find out what has been exposed and get clear guidance on what to do next.