Dark Web Intel: MG Soft Breach Exposed 1,944 South Korean Credentials

HEROIC analysts identified a dataset from MG Soft, a South Korean web and mobile solutions company based in Cheongju, circulating on a hacking forum. Discovered on August 26, 2018, the dataset contains 1,944 records, each pairing an email address with a password hash stored in an unspecified format.

Why This Is Dangerous

Even though the exact hashing method is unconfirmed, any password hash can eventually be reversed with enough time and computing power. Once cracked, the plaintext password is only as valuable as the other accounts it can unlock, which is why the real danger of this breach lies less in MG Soft itself and more in every other account where the same password might have been reused.

What Was Exposed in the MG Soft Breach

• Email addresses
• Password hashes

Why This Matters for the 1,944 People Affected

Small breaches like this one still feed the same credential stuffing pipelines used against much larger targets. Attackers merge modest datasets like MG Soft's into bigger combolists, then test the combined credentials against email providers, banking sites, and other services, turning a single reused password into account takeover, identity theft, or financial fraud.

How This Database Breach Happened

This incident is classified as a database and combolist breach, meaning attackers obtained a direct copy of MG Soft's user records, likely through a vulnerability in the company's website or backend systems, and packaged the emails and hashes for distribution on a hacking forum. From there, the data can be resold or folded into larger combolists that circulate long after the original breach.

Check If You Are Affected

To find out if your email address or password appears in this leak or any other, run a free scan with HEROIC's breach checker, which searches a database of more than 400 billion leaked records.