Dark Web Intel: 18K Credentials From the TBR EAD Education Database Dump

HEROIC analysts found the TBR EAD database circulating on a dark web forum in connection with a breach that first occured in August 2018. TBR EAD is a Brazilian educational platform, and the exposed data includes 18,305 records containing email addresses and MD5 password hashes. The appearance of this dataset on underground markets signals that attackers are actively using it for credential stuffing and account takeover attempts.

How Attackers Exploit Stolen Education Platform Credentials

Student and educator accounts are valuable targets because they often connect to other institutional systems, including university networks, learning management platforms, and professional email accounts. With a cracked MD5 password in hand, an attacker can attempt to log in to those connected accounts directly. Educational credentials are seperate from but often reused alongside work and personal accounts, meaning a single breach like TBR EAD can cascade into much larger unauthorized access across a victim's digital life.

What Was Exposed in the TBR EAD Breach

• Email addresses
• Password hashes (MD5)

Why This Brazilian Education Breach Is a Threat Right Now

Older breach datasets do not lose value over time when the passwords they contain are weak. MD5 hashes are crackable with modern hardware in a matter of hours, and many people have never changed passwords they used on platforms like TBR EAD back in 2018. Attackers bundle datasets like this one into large credential lists and run them through automated tools that test millions of login combinations across popular websites. The risk of account takeover and identity theft remains very real today.

How Database Breaches Work

A database breach happens when an unauthorized party gains access to a website or application's stored user data. Attackers typically exploit vulnerabilities in web software, misconfigured servers, or compromised admin accounts. Once inside, they export the full user table, which includes usernames, email addresses, and password hashes, and then sell or publish that data on dark web forums. Educational platforms are frequent targets because they often run older software and have smaller security teams than large enterprises.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including data from the TBR EAD breach, to tell you whether your email address has been compromised. Run your free scan now and find out if your credentials are already in the hands of attackers.