Search Your Email: The Short Fiction Breach Exposed 9,545 Passwords

HEROIC analysts identified a resurfaced 2016 database breach affecting Short Fiction, a UK-based short story writing community, exposing 9,545 user accounts. The breach originally occurred on March 31, 2016, and includes email addresses, usernames, and passwords secured with the outdated MD5 hashing algorithm. Though the incident is nearly a decade old, the data continues to circulate on dark web trading channels, keeping the risk to affected users very much alive today.

Why the Short Fiction Breach Is Dangerous

MD5 is one of the weakest password hashing methods still found in old databases. It was considered broken more than a decade ago, and modern cracking tools can reverse most MD5 hashes in minutes using rainbow tables or brute force. That means the passwords tied to these 9,545 Short Fiction accounts are effectively exposed to anyone with access to the dump. If any of those users reused the same email and password combination on another site, an attacker could walk right into that account today.

What Was Exposed in the Short Fiction Breach

• Email addresses
• Usernames
• Passwords (MD5 hashed)
• Hash type metadata

Why This Breach Matters

A breach of a niche writing site might seem low stakes, but the real danger isn't Short Fiction itself, it's everywhere else those credentials were reused. Attackers routinely take old, cracked credential lists like this one and run them against banking portals, email providers, and shopping accounts in a technique called credential stuffing. Because this data has been circulating for years, there has been ample time for the passwords to be cracked and tested against other services. Anyone who registered on Short Fiction with a password they still use elsewhere is at meaningful risk of account takeover, identity theft, or financial fraud.

How This Database Breach Happened

This incident falls into the database breach category, meaning an attacker gained direct access to Short Fiction's backend database, likely through a vulnerability in the site's software or an unpatched server. Unlike a stealer log, which harvests credentials from an infected individual's device, a database breach exposes every account the site ever stored in one shot. Once stolen, that data doesn't disappear. It gets copied, repackaged, and resold across dark web marketplaces and Telegram channels for years afterward, which is exactly what has kept this 2016 breach relevant today.

Check If You Are Affected

You don't have to guess whether your email address shows up in this breach or any of the others HEROIC tracks. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including this Short Fiction breach, and tells you immediately if your information has been exposed. If you registered on Short Fiction, or reused a password from that account anywhere else, run a free scan and change any passwords that show up as compromised.