Researchers Link Not Just Church Suits to 5,157 Leaked Passwords

HEROIC analysts identified a dataset tied to Not Just Church Suits, a US-based retailer specializing in church suits, dresses, and group uniforms for women, circulating on a well-trafficked hacking forum. The data is dated August 21, 2018, and contains 5,157 records made up of email addresses and MD5 password hashes. Not Just Church Suits has not confirmed this incident, so it should be treated as an unverified leak rather than a company statement.

Why a Small Boutique Retailer's Leak Still Matters

It is easy to assume a niche clothing retailer is too small a target to worry about, but attackers are not looking for household names, they are looking for reusable credentials. Every one of the 5,157 email and password pairs in this leak is a potential key to a customer's inbox, banking app, or social media account if that password was ever used more than once. Size has nothing to do with the risk here.

What Was Exposed in the Not Just Church Suits Leak

• Email addresses
• Password hashes (MD5 format)

Why This Matters for Anyone Who Reuses Passwords

MD5 hashing has been considered insecure for years and can be cracked quickly with tools readily available online. Once an attacker recovers a customer's actual password, they pair it with the associated email address and try it against major email providers, banks, and shopping sites in a technique known as credential stuffing. Because online shopping accounts often store saved addresses and sometimes payment information, this kind of leak can escalate quickly from a minor annoyance to real financial exposure.

How Database and Combolist Leaks Like This One Spread

This incident is classified as a database leak that has since been folded into combolists, the compiled files of email and password pairs traded among cybercriminals. Typically, an attacker exploits a vulnerability in a retailer's backend systems, extracts the customer table in full, and shares the dataset on a hacking forum, where it merges with other stolen data and continues to circulate. That is how a leak from a small, specialized retailer can end up feeding attacks on completely unrelated services years later.

Check If Your Data Was in the Not Just Church Suits Leak

The only way to know for sure if your email address is part of this leak, or any of the thousands of others HEROIC tracks, is to check. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including this one, and tells you instantly if you need to change a password. If you find a match, update that password everywhere you reused it and enable multi-factor authentication wherever it is available.