Morele.net Data Breach (2018): What Was Exposed & What To Do

In October 2018, the Polish e-commerce site Morele.net suffered a data breach that exposed records belonging to 2.5 million people. The incident was reported on 10 October 2018 and involved email addresses, names, phone numbers and passwords stored as md5crypt hashes. The breach placed personal contact details and login credentials into circulation, creating direct risks for account takeovers and unwanted contact for those affected.

Inside the incident

Public records state that the breach occurred in October 2018 and involved the Polish e-commerce website Morele.net. The reported scale is 2.5 million unique email addresses, together with associated names, phone numbers and passwords held as md5crypt hashes. No further technical details on the method of access, duration of the intrusion or exact files involved have been disclosed in available reporting.

How a breach like this happens

Incidents involving customer databases at online retailers commonly begin with unauthorised access to web servers or backend systems. Attackers may exploit unpatched software, weak authentication controls or stolen administrative credentials to reach stored records. Once inside, they can copy tables containing user information before the activity is detected. The use of older hashing methods for passwords, such as md5crypt, reflects storage practices that were once standard but are now considered less resistant to offline cracking attempts.

About Morele.net

Morele.net operates as an e-commerce platform in Poland, selling consumer electronics and related goods. Like other retailers of its type, it collects customer information at the point of registration and purchase to process orders, manage accounts and handle support requests. The scale of 2.5 million records indicates that the platform held accounts for a substantial portion of its user base at the time of the incident.

What was likely exposed

The facts released about the incident list email addresses, names, phone numbers and passwords stored as md5crypt hashes. No additional categories of data, such as payment card details or order histories, are named in the available reporting. Organisations of this kind routinely store further transactional information, yet the precise contents of the exposed dataset remain unconfirmed beyond the four data types already stated.

Why it matters

Email addresses paired with phone numbers allow targeted phishing or marketing campaigns. Hashed passwords, even when not stored in plain text, can be processed offline if the hashing method is known, potentially leading to account access elsewhere if individuals reused the same credentials. For the organisation, the incident creates obligations around notification, remediation of storage practices and possible regulatory scrutiny under data-protection rules applicable in Poland and the European Union.

Were you affected?

Individuals can check whether their email address appears in known breach datasets through free exposure-scanning services. If matches are found, the immediate steps are to change passwords on the affected account and any other sites where the same password was used, enable multi-factor authentication where available, and monitor for unusual login attempts or unsolicited contact. Organisations that held the data may also provide direct notification or guidance once they complete their own review.

AICompiled with AI assistance from public sources and published under our editorial standards.