2,302 Hashed Passwords From the Shoplando Dump Hit Breach Forums

A database breach at Shoplando, a Greek e-commerce platform, exposed 2,302 customer records in January 2022. The leaked dataset included full identity details and MD5-salted password hashes that were recieved by threat actors who circulated the dump across multiple underground forums and Telegram channels. While the record count is relatively small, the richness of the data makes each record a potent tool for targeted fraud.

What Attackers Can Do With Shoplando Data

The Shoplando breach combines identity data with hashed credentials, giving attackers everything needed for credential stuffing, phishing, and account takeover. MD5 with salt is significantly weaker than modern algorithms, and with full names, phone numbers, and IP addresses also in the dataset, attackers can craft convincing impersonation attacks that are partcularly hard for victims to detect or defend against.

What Was Exposed in the Shoplando Breach

• Email Address
• Phone Number
• Password Hash (MD5 with Salt)
• Username
• First Name
• Last Name
• IP Address
• Salt

Why the Shoplando Breach Remains a Live Threat

Old breach data does not lose its value. The Shoplando records resurfaced on breach forums years after the initial incident, bundled into combo lists used for large-scale credential stuffing campaigns. Users who reused their Shoplando password on banking, email, or shopping accounts remain accessable to attackers who have cracked the MD5 hashes since the breach occured.

How a Database Breach Works

Database breaches happen when attackers exploit misconfigurations, outdated software, or stolen credentials to access a site's backend systems. Once they gain entry, they export user tables containing structured records including account details and stored password hashes. The data is then posted to breach forums or sold on darknet markets, where other actors buy it for credential stuffing, phishing, and identity fraud operations.

Check If Your Data Was Exposed

HEROIC DarkWatch monitors over 400 billion breach records, including data from the Shoplando breach. Search your email address now to instantly check whether your personal information or credentials appear in this or any other known data leak and take action before attackers do.