Stroff Data Breach: 19,411 Records Exposed from Defunct Singaporean Employment Website in 2018

Stroff Data Breach: 19,411 Records Exposed from Defunct Singaporean Employment Website in 2018

Stroff, a now-defunct Singaporean employment website, suffered a data breach in March 2018. The incident exposed 19,411 user records including email addresses and password hashes. What makes this breach technically notable is the mixed hash situation: the dataset contains both MD5 and bcrypt password hashes, indicating the platform was in the process of migrating from MD5 (weak, fast-compute) to bcrypt (purpose-built for password storage) at some point in its lifecycle. Users who registered or updated their passwords after the migration are protected by bcrypt; those on the old system remain protected only by MD5, which is susceptible to rapid cracking. The split creates an uneven risk profile across the 19,411 exposed accounts.

Stroff (March 2018): Data Breach Summary

• Records Exposed: 19,411
• Data Types: Email addresses, password hashes
• Breach Type: Database breach -- unauthorized access to stored user credentials
• Password Type: Mixed MD5 and bcrypt -- the dataset contains both hash types, reflecting an in-progress security migration at the time of breach
• Country: Singapore
• Date Leaked: March 14, 2018

The MD5-to-bcrypt Migration: An Uneven Security Posture

When a platform migrates from a weak hashing algorithm to a stronger one, it typically does so incrementally: existing passwords remain under the old hash until users log in and trigger a re-hash, while new accounts are created with the stronger algorithm. Stroff's dual MD5/bcrypt hash dataset is a textbook example of this pattern. Accounts hashed with bcrypt are significantly more resistant to offline cracking -- a well-configured bcrypt implementation can require months of compute time per password, compared to billions of MD5 checks per second. The practical consequence for Stroff's 19,411 exposed users is that their actual cracking risk depended entirely on when they last logged in or updated their password relative to the migration timeline. Long-inactive accounts or early registrants are far more likely to be in the MD5 cohort and thus more vulnerable.

Employment Platform Breaches: Professional Credential Risk

Job platforms and employment websites occupy a sensitive position in the credential theft ecosystem. Their user bases are active professionals who maintain accounts on LinkedIn, corporate HR portals, payroll systems, and professional email services -- all high-value targets for credential reuse attacks. Stroff's Singaporean user base in 2018 would have been primarily working professionals and job seekers in Singapore's tech and financial sectors, two industries with elevated concentrations of privileged-access accounts. The March 14, 2018 breach date is shared with Thai2Music (Thailand, 19,820 records), suggesting a two-platform simultaneous disclosure consistent with a bulk combolist release. The defunct status of Stroff means affected users have not recieved official breach notification from the platform.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including the Stroff database breach. If your email appears in this dataset, the risk level depends on which hash type protected your password -- but given MD5's weakness, both cohorts should treat the breach as a potential compromise. Run your email through HEROIC's breach scanner to identify all known breach appearances and update passwords on any accounts where you reused your Stroff credentials.