MD5‑protected accounts are policy liabilities

A Kaspersky analysis of over 200 million exposed passwords shows that 60% of MD5‑hashed passwords can be cracked in under an hour on a single Nvidia RTX 5090 (48% under a minute). That transforms server‑side password hashing from a purely technical choice into an operational and legal risk: providers using fast hashes are effectively offering little protection and will face higher breach impact and liability unless they upgrade to slow hashing (argon2/bcrypt), enforce MFA, or move to passwordless options. — It reframes password hashing algorithms (a technical detail) as a governance and consumer‑protection issue that platform operators, regulators, and legislators should address now.