Youku data breach (2016)

In late 2016, Youku (优酷) — one of China's largest online video-streaming platforms, often described as the "Chinese YouTube" and owned by Alibaba Group — suffered a data breach that exposed roughly 92 million unique user accounts. The data later surfaced on dark-web marketplaces before being contributed to Have I Been Pwned in April 2017.

What happened

The compromised database, dated to around 1 December 2016, contained 91,890,110 unique user accounts. Each record included a username and a corresponding MD5 password hash. MD5 is a fast, unsalted hashing algorithm long considered cryptographically broken for password storage — meaning the hashes could be reversed at scale using precomputed rainbow tables and commodity GPU cracking, exposing large numbers of plaintext passwords.

In March 2017, security reporters noted a dark-web listing offering around 100 million Youku accounts for sale. The following month, a verified dataset of 91.8 million accounts was loaded into Have I Been Pwned, contributed by a source identified as rip@creep.im.

Impact

• Approximately 92 million unique accounts were exposed, comprising usernames and MD5-hashed passwords.
• Because the passwords were protected only by unsalted MD5, a substantial share were trivially recoverable, exposing affected users to credential-stuffing attacks across other services where they reused passwords.
• The dataset's appearance on dark-web marketplaces meant the credentials were monetised and broadly distributed rather than confined to the original intruder.

Why it matters

The Youku breach sits within a wave of mega-breaches at major Chinese internet platforms surfacing in 2016–2017, several of which relied on weak, unsalted MD5 password hashing. It illustrates a recurring failure pattern: even very large, well-resourced platforms continued to store credentials with an algorithm unfit for the purpose, turning a database theft into an effectively instant password leak.

For users, the lasting risk is password reuse. Credentials harvested from breaches like Youku feed the combolists that power automated credential-stuffing campaigns worldwide. The incident reinforces the case for salted, slow password hashing (bcrypt, scrypt or Argon2) and for unique passwords backed by a password manager and multi-factor authentication.