The Softrak Systems Dump: 19,233 MD5 Password Hashes Hit the Dark Web

HEROIC analysts identified a data breach tied to Softrak Systems, a Canadian software company that develops accounting and ERP tools for small and medium-sized businesses. The breach was originally recorded in October 2018 and exposed 19,233 user records containing email addresses and MD5 password hashes. The data was leaked on underground cybercrime sources and has since been observed resurfacing on dark web forums and Telegram channels where it is being traded alongside other older breach datasets for use in credential stuffing campaigns. The breach is categorized as both a database breach and combolist, suggesting the original dump was later compiled into attacker-ready credential lists.

Why This Is Dangerous

MD5 is an outdated hashing algorithm that was already considered weak in 2018. Unlike a strong modern hash, MD5 password hashes can often be reversed using freely available tools and precomputed lookup tables called rainbow tables. This means that anyone who obtained this file in 2018 or since then may have already cracked many of the passwords in it. Those cracked passwords can then be tested against other websites the victim uses, a technique called credential stuffing. Because people tend to reuse passwords, a cracked password from a 2018 Softrak account could still work on that persons email, banking, or social media accounts today. The fact that this data is still being actively traded in 2025 means it is still considered valuable by attackers.

What Was Exposed

• Email addresses
• Password hashes (MD5 format, considered weak and crackable)
• 19,233 total user records from Softrak Systems
• Data origin: Canada
• Breach type: Database export and combolist compilation

Why This Matters

Small and medium-sized business software vendors are an often-overlooked attack surface. Companies like Softrak Systems serve thousands of businesses and their employees hold accounts with access to financial data, payroll systems, and business records. When a vendor like this is breached, the ripple effects can reach every business that relies on their platfrom. The Softrak Systems breach also illustrates how breach data compounds over time. A file leaked in 2018 becomes more dangerous as it gets combined with data from other breaches, allowing attackers to build richer profiles on targeted individuals and organisations. The continued circulation of this data in 2025 confirms it still has market value in criminal networks.

How Database and Combolist Breaches Work

A database breach occurs when an attacker accesses a companys backend systems and exports user tables. In many cases the exported file includes hashed passwords rather than plaintext, but that only provides limited protection when the hashing algorithm is outdated like MD5. Once a database is leaked, it often gets cleaned up, formatted, and redistributed as a combolist, which is a file containning email and password pairs ready to be tested against other services. Automated tools can run millions of these combinations against login pages per hour. The Softrak Systems data went through exactly this process, from a raw database dump to a combolist used in credential stuffing attacks years after the original breach.

Check If You Are Affected

If you ever had an account with Softrak Systems or used a business that runs on their software, your email address may have been part of this breach. Even if your Softrak password has changed since 2018, attackers may have already cracked the old hash and tested it elsewhere. HEROIC's free breach scanner searches across over 400 billion records from thousands of breach sources including this Softrak dataset, giving you a complete picture of your exposure. Search your email address now at HEROIC's free breach scanner and find out what criminals may already know about your credentials.