5,790 Piac Passwords Leaked in Plaintext: Change Yours Now

HEROIC analysts found a dataset tied to Piac, a now-defunct Canadian website that supported professional advocacy and public interest initiatives, circulating on a hacking forum. The breach is dated August 26, 2018, and exposed 5,790 records made up of email addresses and plaintext passwords.

Why This Is Dangerous

These passwords were stored as plaintext, meaning there was no encryption protecting them at all. Anyone who gets this file can read every password directly and start trying it against other accounts immediately. There's no cracking required and no delay between the data leaking and it being usable by an attacker.

What Was Exposed

• Email addresses tied to Piac accounts
• Plaintext passwords, stored with no encryption

Why This Matters

Piac shut down years ago, but that doesn't make this leak any less dangerous today. If you ever had an account there and reused that same password anywhere else, that other account is still exposed right now. Attackers regularly comb through old leaks like this one specifically because people forget about accounts on defunct sites and never bother changing the passwords they used, which makes this exactly the kind of data that fuels credential stuffing, account takeover, and identity theft.

How Database and Combolist Breaches Work

This breach traces back to a direct database compromise, where an attacker accessed Piac's stored user records and pulled them out in bulk. Because the passwords were kept in plaintext rather than hashed, the stolen data was usable the instant it left the server. Leaks like this typically end up merged with other breaches into combolists, large combined files of email and password pairs that attackers run against hundreds of websites automatically, hoping to find accounts where the same password still works.

Check If You Are Affected

Don't wait to find out the hard way. Check your email address right now with HEROIC's free breach scanner, which searches a database of more than 400 billion leaked and breached records, and if you find a match, change that password immediately everywhere you've used it.