Hemmakväll Data Breach (2015): What Was Exposed & What To Do

In July 2015, records from the Swedish video store chain Hemmakväll were accessed without authorization and later appeared in a public dump. The incident involved information on roughly 47,000 individuals, including email addresses, names, phone numbers, physical addresses, and passwords. For the people whose details were exposed, the event created lasting questions about how their contact information and login credentials might be used by others.

The breach was reported on 8 July 2015. Public information states that the data was dumped online after the intrusion, but further technical details such as the exact entry method or duration of access have not been disclosed.

Breaking down the breach

The records originated from Hemmakväll’s customer database. They contained names, email addresses, physical addresses, phone numbers, and passwords. The passwords had been stored using the MD5 hashing algorithm, which was already considered weak at the time. Nearly 50,000 records were placed in a publicly accessible location, according to reports from the period.

How a breach like this happens

Incidents involving retail or service databases often begin with an attacker obtaining access to a company’s systems through unpatched software, weak remote-access controls, or compromised credentials. Once inside, the attacker can locate and copy customer tables. In some cases the data is then posted publicly, either to demonstrate the intrusion or to distribute the information further. The use of outdated password hashing such as MD5 makes any recovered credentials easier to process offline.

Who is Hemmakväll?

Hemmakväll operated as a video rental chain in Sweden. Companies in this sector maintain records of customers who rent or purchase media, typically storing contact details to manage accounts, process payments, and communicate about orders or returns. A breach at such an organization therefore touches ordinary transactional information that many households used for routine entertainment services.

What data was at risk

The disclosed records included email addresses, names, phone numbers, physical addresses, and passwords. The exact contents of every record remain unconfirmed beyond these categories. Organizations of this type commonly hold additional fields such as payment references or rental history, yet no further data types have been verified in public reports of this incident.

Why it matters

Contact details combined with passwords can be tested against other online accounts, since many people reuse credentials. Physical addresses and phone numbers may be used for unsolicited contact or to support more targeted attempts at fraud. For the organization, the event highlighted the long-term consequences of storing customer information without stronger protective measures such as modern password hashing.

If your data was in this breach

Change any password still in use that matches the leaked credentials, and avoid reusing it elsewhere. Enable multi-factor authentication on accounts that support it. Review statements from banks or services for unexpected activity. Readers can run a free exposure scan of their email address against known breach data to check for additional appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.