The Songtradr Leak Is Bigger Than Most Artists’ Email Lists

HEROIC analysts detected a data posting on a prominent underground hacking forum on August 26, 2018. The exposed dataset was attributed to Songtradr, a U.S.-based B2B music licensing and distribution platform used by artists, publishers, and brands worldwide. A total of 5,826 user records were compromised, containing email addresses and MD5 password hashes. While the record count may seem modest, the combination of account credentials with a weakly hashed password format creates a disproportionate risk. MD5 is widely considered a broken hashing algorithm, meaning these passwords were effectivly exposed in near-plaintext form to anyone with basic cracking tools.

Why the Songtradr Breach Is Dangerous

MD5 password hashes have a well-documented weakness: they can be reversed using precomputed rainbow tables or cracked through brute-force in a matter of seconds for common passwords. When attackers obtain an MD5 hash, they do not need the original password. They compare the hash against massive prebuilt databases of known password-hash pairs, and in many cases, the original password is recoverd within moments. For music industry professionals who used Songtradr for licensing deals, sync rights, or artist representation, a compromised account could expose sensitive business communications, contract details, and proprietary creative assets.

What Was Exposed in the Songtradr Breach

• Email Address
• Password Hash (MD5)

Why the Songtradr Breach Matters

Songtradr operates at the intersection of music, technology, and commerce. Users of the platform include independent artists, record labels, advertising agencies, and streaming services. The exposure of their login credentials creates a cascading risk: if any of these users reused the same password across other platforms, those accounts are now compromised as well. The breach was posted on a prominent hacking forum, meaning it was immediately accessable to a wide audience of threat actors who specialize in credential stuffing and account takeover. Even years after the initial exposure, these credentials continue to circulate and are actively used in automated login attacks against major platforms.

How a Database and Combolist Breach Works

A database breach occured when an attacker successfully accesses a backend data store, often through SQL injection, exposed administrative panels, or stolen server credentials. The resulting data dump is then packaged and distributed as a combolist, which is a formatted text file pairing email addresses with their corresponding passwords or hashes. Combolists are a primary currency on hacking forums, where they are traded, sold, and merged with other datasets to build increasingly comprehensive credential repositories. Once in circulation, a combolist from a 2018 breach remains just as dangerous in 2026 because millions of users have never changed their passwords since the original incident.

Check If Your Songtradr Account Was Compromised

HEROIC's free breach scanner searches more than 400 billion records, including the Songtradr dataset, to determine whether your email address has been exposed in a known data breach. If your credentials were included in this or any other incident, you will see exactly what was leaked and what steps to take. Run a free scan now at heroic.com before your old password is used against you.