If You Reuse Passwords, the PetFlow Breach Should Worry You

HEROIC analysts identified the PetFlow database breach as it recieved renewed circulation across underground forums in May 2020. The breach exposed 931,119 records from PetFlow, a pet food delivery service, compromising email addresses and MD5 password hashes. The data was originally placed on sale by the GnosticPlayers threat group before spreading to wider hacking communities.

Why MD5 Password Hashes Put PetFlow Users at Risk

MD5 hashes are partcularly weak because attackers can crack them using precomputed rainbow tables in minutes. Once cracked, those passwords become live credentials that can be tested across banking sites, email accounts, and other e-commerce platforms through automated credential stuffing tools. Anyone who reused their PetFlow password elsewhere faces direct account takeover risk.

What Was Exposed in the PetFlow Breach

• Email Address
• Password Hash (MD5)

Why the PetFlow Breach Still Matters for E-Commerce Account Security

E-commerce accounts hold saved payment methods, shipping addresses, and purchase histories. When credentials from a breach like PetFlow are cracked and reused, attackers can take over accounts on other shopping platforms, access stored card data, and commit fraud. The breach occured in 2020 but the risk persists wherever those passwords were reused.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend database, typically by exploiting a vulnerability in a web application, misconfigured server, or stolen administrative credentials. The attacker exports the database contents, which may include user records, hashed passwords, and personal details, and then distributes or sells the data through underground channels.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you whether your email address appears in the PetFlow breach or any other known data leak. Run a free scan now to find out what information about you is accessable to threat actors.