One Database File. 19,940 Records. The SMS Snabb Lan Breach Went Dark Web.

HEROIC analysts identified a data breach affecting SMS Snabb Lan Svenskasajter, a now-defunct Swedish financial website that provided SMS-based quick loan services. The breach was first observed in August 2018, exposing the records of 19,940 users. The leaked data included email addresses and MD5 password hashes, which were extracted from the site's database and distributed across underground forums and combolists. Despite the site being defunct, the credentials remain active in threat actor toolkits and continue to be tested against other platfoms today.

Why This Is Dangerous

Financial services websites attract users with higher-value credentials -- people who are accustomed to using strong, memorable passwords they reuse across banking, email, and work accounts. When a site like SMS Snabb Lan loses its database, attackers do not just get credentials for a defunct loan platform. They get a starting point for attacking every other account that user has. MD5 password hashes, while technically requiring some cracking effort, are notoriously weak by modern standards. Free tools and pre-computed rainbow tables can crack most MD5 hashes in seconds, effectively making this breach nearly as dangerous as a plaintext password leak.

What Was Exposed

• Email addresses -- 19,940 Swedish user accounts
• MD5 password hashes -- weak hashing easily cracked with modern tools
• Industry: Financial services (SMS-based quick loans)
• Country of origin: Sweden
• Breach structure: Database export distributed via underground forums and combolists
• Date first observed: August 26, 2018

Why This Matters

A defunct financial website is in some ways more dangerous than an active one. There is no incident response team, no notification process, no patch, and no password reset prompt coming. The 19,940 people whose data was taken from SMS Snabb Lan Svenskasajter most likely have no idea this breach ever happend. Their credentials have been silently traded and tested for nearly seven years. Anyone who reused that password on another site should consider it fully compromised, regardless of how long ago they last visited smsblan.se.

How MD5 Hash Cracking Works

When a website stores passwords using MD5 hashing, it converts each password into a fixed-length string of characters using a mathematical function. The idea is that the original password cannot be recovered from the hash. In practice, MD5 was declared unsuitable for password storage over a decade ago. Attackers use rainbow tables -- giant pre-computed lists of common passwords and their MD5 equivalents -- to reverse thousands of hashes in minutes. For passwords not in rainbow tables, tools like Hashcat can test billions of guesses per second on consumer hardware. The result is that most MD5-hashed passwords from 2018 are now effectivly cracked.

Check If You Are Affected

If you ever had an account on SMS Snabb Lan Svenskasajter or the domain sms-snabb-lan.svenskasajter.com, your email and a crackable password hash were exposed. HEROIC's free breach scanner searches your email across a database of over 400 billion leaked records from breaches around the world. Find out in seconds whether your credentials appear in this or any other known data leak. Start your free scan at HEROIC and see exactly where your data has surfaced.