Basically, sensitive information was simply MD5 hashed. Since the input was limited (3 numbers, 3 letters, at most), it was easy to make some brute-force attack: generate all possible combinations and then do a look-back.
Considering the nature of the information (very small input, to easy to generate all combinations), how could this data be properly anonymized?
Some approaches that have occurred to me, but which don't work:
Security through obscurity (use a "secret" number of iterations) is just security through obscurity.
Append a general, unique salt, would increase the brute-force by 0%: simple append the salt and done.
Appending a unique salt per user, would increase the brute-force, but not too much: take the salt and calculate the 3 digit 3 letters for each salt.
What could be done?