JustFabrics Data Breach: 73,612 UK Customer Records Exposed

73,612 JustFabrics UK Customers Exposed in 2018 Data Breach

In August 2018, JustFabrics -- a UK-based fabric and sewing supplies ecommerce platform at justfabrics.co.uk -- suffered a data breach exposing 73,612 customer records. The compromised data included email addresses and password hashes, with passwords protected by either SHA1 or bcrypt depending on when and how the account was created. The presence of two different hashing algorithms suggests the platform went through a security upgrade at some point but may not have rehashed all existing passwords to the stronger standard.

JustFabrics Data Breach: Breach Summary

• Records Exposed: 73,612
• Data Types: Email addresses, password hashes (SHA1, bcrypt)
• Breach Type: Database breach
• Country Affected: United Kingdom
• Date Leaked: August 2018

SHA1 vs. Bcrypt: Why the Hashing Algorithm Matters

The two password algorithms in the JustFabrics breach represent very diferent levels of protection. Bcrypt is considered strong for password storage -- it's slow by design, making brute-force attacks costly and time-consuming. SHA1, on the other hand, was not designed for password hashing and runs extremly fast, allowing attackers to test hundreds of millions of guesses per second. A SHA1-hashed password with moderate complexity can be cracked in minutes or hours with standard hardware. A bcrypt-hashed password with the same complexity would require vastly more computational effort. JustFabrics customers whose passwords were stored in SHA1 should treat their credentials as compromised; those stored in bcrypt have significatly more protection, though strong unique passwords remain essential.

Mixed Hashing as a Sign of Incomplete Security Migration

The presence of two hashing algorithms in a single database is a common finding in breaches of platforms that have undergone security improvements over time. When a site upgrades its password hashing, it typicaly applies the new algorithm to new accounts and to existing accounts when users log in and trigger a rehash. Users who haven't logged in since the upgrade remain on the old algorithm. JustFabrics' mixed SHA1/bcrypt database suggests some customers were protected by the stronger algorithm while others -- likey longer-tenured accounts -- remained on the weaker one, creating a two-tiered victim pool with very diferent real-world risk levels.

Check Your Exposure in HEROIC's Free Scanner

HEROIC's free breach scanner searches across more than 400 billion exposed records, including UK ecommerce breaches like the JustFabrics incident. Enter your email to see if your credentials were exposed. If you used the same password on JustFabrics as you use on other platforms, changing that password now is the most directly protective step you can take.