eHarmony Password Dump Analysis
Unless you've been hauled up in a bunker, eating MREs and watching Doomsday Preppers marathons, you've likely heard of the recent compromise of over 1.5 million eHarmony password hashes. After a little work tracking down the hashes, we launched several attacks …
Context & Ripple Effects
The confirmed compromise of more than 1.5 million eHarmony password hashes has moved into its analysis phase: Trustwave's SpiderLabs team tracked down the leaked dump and ran several cracking attacks against it, converting an abstract theft announcement into a measured picture of how many of those passwords actually fall.
The story travelled fast — CNET and The Register both picked up the SpiderLabs work on or about June 25, 2012 — which matters because a published crack rate turns password storage quality at one dating site into a public benchmark that users and press will implicitly apply to every other site holding similar data.
First-order effects
- The 1.5 million affected eHarmony users now have hashed passwords in circulation that independent researchers can crack at published speeds, making rapid credential resets the immediate containment task for the company.
- With CNET and The Register covering the SpiderLabs analysis the same day, eHarmony's breach response plays out under mainstream scrutiny rather than in security-trade circles alone.
Second-order effects
- Users who reused these passwords on email or other accounts face exposure well beyond the dating site, so the blast radius of the dump depends on reuse habits the breached company cannot see or reset.
- Rival dating and social services come under pressure to re-examine their own password storage, since each publicly cracked dump raises the question of how their hashes would fare under the same attacks.
Third-order effects
- Breach disclosure is shifting from 'data was stolen' toward independent third parties measuring how quickly stolen hashes crack, inserting forensics firms like SpiderLabs into the incident narrative alongside the breached brand.
- If large hash dumps with published crack rates keep accumulating through 2012, password-hashing choices stop being an invisible implementation detail and become a liability driver pushing sites toward slower, salted schemes.
The trend: Large credential dumps are hardening into a recurring 2012 pattern in which independent security teams publicly crack the stolen hashes, turning password strength into measurable public evidence against the breached company.