Inside the ToonDoo Breach: How a Database Dump Exposed 6M Passwords

HEROIC analysts discovered the ToonDoo database breach, which occured in August 2019 and exposed 6,019,822 user accounts from the comic strip creation platform. The leaked records included email addresses, first and last names, MD5 password hashes, and salts, providing attackers with everything needed to crack passwords and impersonate users across other services.

How MD5 Password Hashes From ToonDoo Enable Mass Account Takeover

MD5 is a deprecated hashing algorithm that modern hardware can crack at billions of attempts per second. With 6 million salted MD5 hashes in hand, attackers run optimized cracking tools to recover plaintext passwords. Those cracked credentials are then systematically tested against email providers, social networks, and corporate login portals, a technique beleived to be responsible for a significant share of account takeover incidents today.

What Was Exposed in the ToonDoo Breach

• Email Address
• Salt
• First Name
• Last Name
• Password Hash

Why 6 Million Creative Platform Accounts Are a Stepping Stone to Bigger Targets

Users who signed up for ToonDoo recieved no indication their credentials were circulating on hacking forums. Because many people reuse passwords across personal and work accounts, a breach of a creative platform becomes accessable intelligence for attackers targeting corporate environments. The combination of full name, email, and crackable password hash creates a ready-made spear phishing profile.

How Database Breaches Work

A database breach occurs when attackers exploit a vulnerability in a web application or its supporting infrastructure to extract stored user data. The attacker gains read access to backend tables, copies user records including hashed credentials, and then distributes the data on underground forums. The breach may go undetected for months or years, as was the case with ToonDoo.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches 400 billion+ leaked records to tell you instantly whether your email address appeared in the ToonDoo breach or thousands of other incidents. Run your free scan at HEROIC.com to see what attackers may already know about you.