The Times of AP Breach Means Someone Could Already Be Accessing Your Accounts

HEROIC analysts identified a data breach affecting Times of AP, a regional digital news outlet serving the Telugu-speaking states of Andhra Pradesh and Telangana in India. The breach was discovered when a dataset containing 2,179 records surfaced on a prominent hacking forum in July 2018. The exposed data included email addresses and MD5 password hashes. While MD5 hashing provides some protection, it is a weak algorithm that has been largely broken by modern cracking techniques, meaning these passwords were effectively compromised at the moment of publication.

Why the Times of AP Breach Is Dangerous

Picture this: your email address and the password you used to sign up for a news site are now sitting in a database on a hacking forum. A threat actor runs your MD5 hash through a pre-computed rainbow table and recovers your original password in seconds. They then try that password on your Gmail, your bank, your social media accounts. If you reused that password anywhere, the damage may have allready occured years before you ever heard about this breach. MD5 cracking is not theoretical -- it is automated, fast, and widely available to anyone with a basic interest in credential abuse. The Times of AP breach created exactly this type of exposure for 2,179 users, many of whom likely never knew their data was at risk.

What Was Exposed

• Email Address
• Password Hash (MD5)

Why This Matters

Regional news outlets are frequently overlooked in cybersecurity conversations, but they collect the same types of user credentials as major platforms. A user who registered on Times of AP in 2017 or 2018 may have used a password they also use on LinkedIn, Outlook, or their online banking portal. When that credential pair is harvested, combined with other breach datasets, and loaded into a combolist tool, it becomes a skeleton key targeting accounts far more valuable than a regional news subscription. MD5 hashed passwords from this era are trivially crackable -- studies have shown that over 80 percent of MD5-hashed passwords from publicly leaked databases can be recovered using freely available tools and wordlists. This means the password hash protection offered almost no real seperate defense against a motivated attacker.

How Database and Combolist Breaches Work

A database breach typically begins when an attacker identifies and exploits a vulnerability in a web application -- commonly an SQL injection flaw, an unpatched plugin, or misconfigured server permissions. Once access is gained, the attacker exports the user credentials table directly. In the case of Times of AP, the breach type is classified as both a database compromise and a combolist, meaning the extracted records were subsequently merged with other stolen credential sets and distributed broadly across underground forums. Combolists are designed for scale: automated tools ingest thousands of email-password pairs and test them against login pages for popular services simultaneously. The MD5 hashing used by Times of AP offered minimal resistance, as this algorithm was deprecated for password storage over a decade ago due to its speed and vulnerability to rainbow table attacks.

Check If You Were Affected

If you ever registered an account on Times of AP or timesofap.com, your credentials may be part of this dataset. Use the HEROIC free breach scanner to search your email address across more than 400 billion compromised records. If your email appears in this or any other breach, change affected passwords immediately and enable two-factor authentication on all important accounts. The earlier you act, the less damage a threat actor can do with your data.