Credential theft
eHarmony Password Hash Breach (1.5M Unsalted MD5 Passwords)
Primary Source βIncident Details
eHarmony, the US online dating service, disclosed on June 6, 2012 that a subset of its member passwords had been compromised and posted online. Approximately 1.5 million unsalted MD5 password hashes were published to a Russian hacking forum β the same forum where the contemporaneous LinkedIn 6.5 million password hash dump appeared within the same week (June 5β6, 2012). Unsalted MD5 hashes are trivially cracked using rainbow tables and dictionary attacks; security researchers cracked the majority within hours. eHarmony reset affected member passwords proactively. The coincidental timing with the LinkedIn breach during the same week in June 2012 drew attention to the widespread industry practice of storing passwords as unsalted MD5 hashes β a practice now considered a fundamental security failure. The incident reinforced the industry shift toward properly salted, slow password hashing algorithms (bcrypt, scrypt, Argon2). eHarmony serves tens of millions of members globally.
Technical Details
- Initial Attack Vector
- Unauthorized access to eHarmony's user database; attackers obtained and published approximately 1.5 million unsalted MD5 password hashes online
Timeline
- 2012-05-01 Breach occurred
- 2012-06-06 Publicly disclosed
- 2012-06-06 Customers notified