78,419 Passwords From the Supras Unisono Dump Are Now on the Dark Web

HEROIC analysts surfaced the Supras Unisono breach while tracking credential compilations being distributed across underground data markets in 2024. The breach itself occured in April 2018 when this Czech fan merchandise provider, known for producing scarves, flags, and supporter gear for football clubs across Central and Eastern Europe, had its entire user database stolen. The incident exposed 78,419 records containing email addresses and password hashes. The hashing algorithm used was MD5, which is so outdated that most passwords protected by it can be cracked within seconds using modern hardware, meaning these credentials were effectively as dangerous as plaintext from the moment the database was stolen.

Why Crackable MD5 Hashes From Supras Unisono Put Users at Risk

MD5 is a hashing method that was retired from security use years ago because it is far too easy to reverse. Attackers use massive precomputed tables called rainbow tables to look up the original password behind any MD5 hash almost instantly. For any hash not in those tables, automated cracking tools can test billions of guesses per second until they find a match. The practical result is that the 78,419 password hashes in the Supras Unisono breach are not meaningfully different from plaintext passwords. Once cracked, those credentials are paired with the associated email addresses and tested against popular platforms, banks, and shopping sites through a process called credential stuffing. Users who recieved similar passwords across other services face a real and ongoing risk of account takeover.

What Was Exposed in the Supras Unisono Breach

• Email Address
• Password Hash

Why Fan Community Breaches Lead to Broad Account Takeovers

A defunct fan merchandise site might seem like a low-stakes target, but the credentials stored in its database are just as useful to attackers as those from a major retailer. People who bought supporter gear from Supras Unisono likely used an email address and password they also use for online banking, streaming services, or workplace accounts. Credential stuffing attacks are fully automated and test stolen credentials against hundreds of services simultaneously. This means a single Supras Unisono password could unlock a Netflix account, an Amazon account, or a company email, leading to identity theft, financial fraud, and in some cases access to sensitive business systems. The 2018 breach date also means many users have never thought to change a password they created over seven years ago.

How a Database Breach Works

A database breach occurs when an attacker finds a way into the server where a website stores user information. This typically happens through known software vulnerabilities that were not patched, weak or stolen login credentials for the server itself, or a misconfigured database that was left open to outside connections. Once access is gained, copying the entire user database takes only a few minutes. The attacker walks away with a file containing every user account, and in the case of Supras Unisono, the MD5-hashed passwords in that file were trivially crackable, leaving users exposed well beyond the initial incident.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records gathered from thousands of known breach databases, including the Supras Unisono incident. Visit HEROIC now to scan for free and find out whether your credentials are already circulating on dark web markets before an attacker uses them against you.