Analysts Find 789 Spider Sport Accounts Stored in Weak MD5

HEROIC Cybersecurity analysts identified 789 user records from Spider Sport, a Bulgarian fitness platform, exposed in a database breach on February 3, 2025. The leak, tied to spidersport.com, contained email addresses, usernames, and password hashes stored using the obsolete MD5 algorithm.

Why This MD5 Breach Is Dangerous

MD5 has been considered broken for password storage for more than a decade. Without salting or modern key stretching, attackers can crack large portions of an MD5 password list in hours using consumer-grade GPUs or precomputed rainbow tables. Everyone in this 789 record list should assume their original password is effectively plaintext in attacker hands.

What Was Exposed in Spider Sport

• 789 user records from spidersport.com
• Email addresses
• Usernames
• Password hashes stored as MD5

Why This Matters

Once attackers crack the MD5 hashes, they will test the recovered email and password pairs against banks, webmail, and cloud services through credential stuffing. Anyone who reused their Spider Sport password on a more valuable account is at immediate risk of account takeover. The exposed email addresses also feed identity theft workflows and targeted phishing, where scams can be tailored to a victim's fitness and wellness interests.

How Database Breaches With MD5 Hashes Play Out

Attackers typically extract a vulnerable site's user table through SQL injection, an exposed backup, or a compromised admin account. They then run the MD5 hashes through hashcat against common password wordlists and previously leaked credential sets. Matches are combined with the original email addresses to produce a clean credential stuffing list, which is then traded on dark web forums and Telegram channels alongside other small-to-mid size breaches.

Check If You Are Affected

HEROIC's DarkHive scanner searches more than 400 billion exposed records, including the Spider Sport dataset. Search your email to see if your account was in the leak, rotate your Spider Sport password, change any account that reused that same password, and enable multi-factor authentication on high-value services.