Ontario Curling Tour Hack: Email and Password Hashes of 13K Leaked

HEROIC's DarkHive intelligence system discovered the Ontario Curling Tour data breach, exposing 13,076 records. The breach occured in August 2018 and targeted this Canadian regional sports organization. Attackers accessed email addresses and password hashes, with a concerning mix of both outdated MD5 and more modern bcrypt algorithms found in the leaked data.

Why This Is Dangerous

The presence of MD5 password hashes makes this breach particularly serious. MD5 is a broken hashing algorithm that can be cracked in seconds using modern hardware and precomputed rainbow tables. Attackers who obtained this database can quickly recover plaintext passwords for a large portion of affected users. Those recovered passwords are then tested against email services, banking platforms, and social media accounts through automated credential stuffing tools. Even the bcrypt-protected passwords remain at risk from targeted brute-force attacks over time.

What Was Exposed

• Email Address
• Password Hash (MD5 and bcrypt)

Why This Matters

Sports and recreational organizations often store member data without the same security investment as commercial platforms. Breached credentials from these sources feed directly into combolist attacks that target more valuable accounts. Users who recieve their sports club membership email and use the same password elsewhere are at risk of account takeover, identity theft, and fraud. Enterprises should monitor whether employee email addresses appear in niche breaches like Ontario Curling Tour, since attackers frequently use credential stuffing as an entry point into corporate networks.

How Database and Combolist Breaches Work

A database breach occures when attackers extract records from a site's backend storage, often exploiting unpatched software or weak administrative credentials. The stolen data is then compiled into combolists: large files containing email and password pairs ready for automated attacks. Combolists from smaller organizations like Ontario Curling Tour are widely traded on dark web forums and Telegram channels, giving many attackers access to the same stolen credentials. The mixed use of MD5 and bcrypt in this breach suggests the organization had inconsistent security practices, a seperate risk factor that often signals other vulnerabilities.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Ontario Curling Tour. Visit heroic.com to scan your email address and find out if your information was exposed. Taking action early can prevent attackers from using your credentials before you change them.