7,963 MD5-Hashed Passwords From World Curling Tour Just Resurfaced

HEROIC analysts identified a database leak tied to World Curling Tour (worldcurl.com), a curling sports platform. The breach is dated February 4, 2016, and exposed 7,963 records, including email addresses, usernames, passwords hashed with MD5, and the associated hash type.

Why an MD5-Hashed Leak Like This Is Dangerous

MD5 is an older hashing method that's now considered weak by modern security standards, since it can often be cracked with widely available tools. That means passwords from this breach are more likely than newer, stronger hashes to eventually be converted back into their original plaintext form, giving attackers a working password to pair with each email and username in the set.

What Was Exposed in the World Curling Tour Database

• Email addresses
• Usernames
• Passwords (MD5 hash format)
• Hash type metadata

Why This Matters Even for a Niche Sports Site

A sports membership site might seem low stakes, but the same email and password combination people used here is often the exact one they still use for banking, email, or work logins. Once a weak MD5 hash is cracked, attackers can run that credential through automated tools against dozens of other websites in a process known as credential stuffing, hoping the same password unlocks something more valuable.

How This Database Breach Likely Happened

This incident is recorded as a database breach, meaning the records were extracted directly from stored data rather than harvested one login at a time through malware. Sites storing passwords with MD5 are typically compromised through a vulnerability or misconfiguration in the website's software, letting an attacker copy the full user table at once. Because MD5 offers weak protection, the passwords inside a leak like this carry more risk than one hashed with a modern, stronger algorithm.

Check If You Are Affected

If you've ever registered on a niche hobby or sports site and reused a password, it's worth checking your exposure. HEROIC's free breach scanner searches more than 400 billion leaked records, including breaches like this one, so you can see where your information has appeared and update any passwords still in use.