123rf.com
Mar 1, 2020
Breach of 123RF, a stock photo and image website. The dataset contains member records including usernames, MD5-hashed passwords, names, addresses, phone numbers, email addresses, IP addresses, registration dates, payment methods, and linked social account IDs (Google, Facebook). The data was circulated on BreachForums.
Data found in this dataset
Source files
Expand any file to inspect its column headers and the LLM's field-mapping reasoning, recorded during ingestion.
123RF_BF__data__123rf.com_member__member.csv16 columns8,604,753 rows
File structure
Format: CSV·Delimiter: comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 2 | password | high | [2] header 'md5password', values are 32-character MD5 hashes of passwords |
| 4 | firstName | high | [4] header 'first_name', values are given names (Ivan, Alexandra, etc.) |
| 5 | lastName | high | [5] header 'last_name', values are family names (Meivan, Seuh, etc.) |
| 6 | address1 | high | [6] header 'street1', values are street addresses |
| 7 | address2 | high | [7] header 'street2', values are secondary address components |
| 8 | city | high | [8] header 'city', values are city names |
| 9 | state | high | [9] header 'state', values are region/state names |
| 10 | country | high | [10] header 'country', values are ISO country codes (RU, KG, CI, HU) |
| 11 | zip | high | [11] header 'postcode', values are postal codes |
| 12 | phone | high | [12] header 'phone', values are phone numbers with country codes and formats |
| 13 | high | [13] header 'email', values contain @ and are email addresses | |
| 20 | high | [20] header 'paypal_email', values are email addresses used for payments | |
| 42 | high | [42] header 'google_email', values are email addresses linked to Google accounts | |
| 43 | high | [43] header 'facebook_email', values are email addresses linked to Facebook accounts | |
| 44 | facebookId | high | [44] header 'google_id', values are numeric identifiers for Google social accounts |
| 45 | facebookId | high | [45] header 'facebook_id', values are numeric identifiers for Facebook social accounts |
Notes: 48 columns total, 16 contain PII. Column [1] 'password' (plaintext) is empty across all rows shown; column [2] 'md5password' contains the actual hashed passwords. Columns [3], [24] (business/company names) and [33] (IP address) are correctly skipped per exclusion rules. Data includes encoded Cyrillic characters (HTML entities) in many fields.