If You Ever Shopped on Solo-Classika, Your MD5 Password Hash Is Likely in a Hacker’s Database

HEROIC analysts flagged this breach while monitoring underground sources for compromised datasets originating from Russian e-commerce platforms. In August 2018, Solo-Classika, a discontinued Russian website that sold laboratory glassware, had its user database stolen and published. The breach exposed 7,853 records, each containing an email address and an MD5 password hash. Although MD5 hashes are not plaintext, they are considered broken by modern cryptographic standards and can be reversed quickly using widely available tools and precomputed lookup tables called rainbow tables.

Why This Is Dangerous

MD5 is an outdated hashing algorithm that was never designed for password storage. It runs extreamly fast, which means attackers can test billions of password guesses per second using standard graphics cards. Most common passwords, and many uncommon ones, can be cracked from an MD5 hash in seconds to minutes. Once cracked, those passwords can be tested against the victim's email, social media, banking apps, and any other accounts where the same password might have been used.

What Was Exposed

• Email addresses (7,853 unique accounts)
• MD5 password hashes (easily crackable with modern tools)
• Source: Database and combolist export
• Date leaked: August 21, 2018
• Country: Russian Federation

Why This Matters

Even years after the breach, this data circulates in underground marketplaces and combolists. If a Solo-Classika user reused their password on other services, attackers who cracked the MD5 hash back in 2018 may have already tested it across dozens of other platforms. Email addresses from the breach are also valuable on their own for phishing campaigns and social engineering attacks. The fact that this site sold laboratory supplies means some users may have been professionals whose credentials could be used to target their employers or organisations.

How MD5 Hash Cracking Works

When a website stores your password as an MD5 hash, it converts your password into a fixed string of characters using a mathematical function. The idea is that this hash cannot be reversed back to the original password. However, MD5 hashes are deterministic, meaning the same password always produces the same hash. Attackers use precomputed tables of common passwords and their MD5 equivelants to look up hashes instantly, or they use GPU-accelerated brute force tools to try millions of combinations per second. For most real-world passwords, MD5 provides almost no protection against a motivated attacker with modern hardware.

Check If You Are Affected

If you ever created an account on Solo-Classika or the domain solo-k.ru, your email address and password hash may be in this dataset. HEROIC's free breach scanner checks against more than 400 billion compromised records to tell you instantly what has been exposed about you online. Check your email now with HEROIC's free breach scanner and see if your account credentials have been compromised in this or any other known breach.