Credential theft

eHarmony Password Hash Breach (1.5M Unsalted MD5 Passwords)

πŸ“… 2012-05-01
Primary Source β†—

Incident Details

eHarmony, the US online dating service, disclosed on June 6, 2012 that a subset of its member passwords had been compromised and posted online. Approximately 1.5 million unsalted MD5 password hashes were published to a Russian hacking forum β€” the same forum where the contemporaneous LinkedIn 6.5 million password hash dump appeared within the same week (June 5–6, 2012). Unsalted MD5 hashes are trivially cracked using rainbow tables and dictionary attacks; security researchers cracked the majority within hours. eHarmony reset affected member passwords proactively. The coincidental timing with the LinkedIn breach during the same week in June 2012 drew attention to the widespread industry practice of storing passwords as unsalted MD5 hashes β€” a practice now considered a fundamental security failure. The incident reinforced the industry shift toward properly salted, slow password hashing algorithms (bcrypt, scrypt, Argon2). eHarmony serves tens of millions of members globally.

Technical Details

Initial Attack Vector
Unauthorized access to eHarmony's user database; attackers obtained and published approximately 1.5 million unsalted MD5 password hashes online

Timeline

  1. 2012-05-01 Breach occurred
  2. 2012-06-06 Publicly disclosed
  3. 2012-06-06 Customers notified