The Expedice CR Breach Means Someone Could Already Have Your Password

HEROIC analysts identified a database from Expedice CR, a Czech tourism platform, shared on a hacking forum. The breach is dated to August 26, 2018, and exposed 12,857 records, including email addresses along with a mix of plaintext passwords and MD5 password hashes.

Why the Expedice CR Password Mix Is Dangerous

Some of the passwords in this breach were stored as plaintext, meaning they can be read and used immediately. The rest were hashed with MD5, an algorithm considered weak by modern standards and crackable with widely available tools. In practice, that means most of the passwords in this dataset can end up back in readable form, ready to be tried against other accounts.

What Was Exposed in the Expedice CR Breach

• Email addresses
• Plaintext passwords
• MD5 password hashes

Why This Matters Years Later

A breach from 2018 might feel like old news, but leaked credentials rarely expire. If you had an Expedice CR account and reused that password anywhere else, whether for email, banking, or shopping, someone could already be sitting on a working copy of your login. Data like this regularly resurfaces in credential stuffing attacks, where automated tools test old email and password pairs against current accounts, leading to account takeover, identity theft, or financial fraud.

How a Database and Combolist Breach Like This Spreads

This incident is classified as a database and combolist breach. The original data was pulled from Expedice CR's user database, then repackaged into combolists, files that pair emails with passwords or hashes, which get traded and reused on hacking forums long after the original breach occurred.

Check If You Are Affected

Use HEROIC's free breach scanner to check whether your email appears in the Expedice CR breach or any other leak. It searches a database of more than 400 billion leaked records so you can find out and change any passwords you may have reused.