The SmartHem Breach Made Identity Theft Easier for 53,971 People

HEROIC analysts identified a database leak from SmartHem, a now-defunct Swedish e-commerce platform that sold home furniture and appliances. The data surfaced on a hacking forum, tracing back to April 3, 2018, and exposed 53,971 records made up of email addresses and plaintext passwords.

Why This Is Dangerous

Because SmartHem stored passwords in plaintext, there was no hashing standing between the leaked data and the accounts it belonged to. Anyone with this dataset can read every password directly and pair it immediately with the matching email address, with no cracking step required.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Identity theft becomes a lot easier once an attacker has a working email and password pair. For the 53,971 people in this leak, that pair can be tried against email accounts, banking sites, and other services through credential stuffing, and if the password was reused anywhere else, the risk extends well beyond SmartHem to account takeover and financial fraud on accounts that have nothing to do with the original site.

How This Database Leak Happened

This incident is classified as a database and combolist leak, meaning attackers pulled the data directly from SmartHem's backend, likely through a vulnerability in the site itself, and compiled it into a combolist, a simple list of email and password pairs built for reuse. Because SmartHem never hashed its passwords, this leak went from raw database dump to fully usable credential list without attackers needing to do any additional work.

Check If You Are Affected

If you ever had an account on SmartHem or reused a password across multiple sites, HEROIC's free breach scanner can check your email address against a database of more than 400 billion leaked records, including this one. Run a scan now to see if your information was exposed.