The 8Tracks Breach Hit More Users Than Live in the State of Illinois

HEROIC analysts flagged the 8Tracks breach while tracking renewed activity around older music platform databases on dark web forums. The incident occured in June 2017, when attackers gained access to the 8Tracks infrastructure through an employee GitHub account that was not protected by two-factor authentication. A total of 16,556,692 user records were compromised, containing email addresses, usernames, password salts, and SHA-1 password hashes. The reemergence of this data in active cracking discussions on breach forums suggests that some of those hashed passwords have already been recovered by attackers.

Why SHA-1 Password Hashes Are No Longer Safe

SHA-1 was once a common way to store passwords, but security standards have moved far beyond it. Modern cracking tools can test billions of SHA-1 guesses per second using consumer hardware. If your 8Tracks password was a common word, a name, or a short phrase, it is very likely that attackers have already cracked it. Once cracked, those passwords become usable in credential stuffing attacks across every site where you recieved that same password. The salt included in this breach slows cracking but does not stop it, partcularly for weaker passwords.

What Was Exposed in the 8Tracks Breach

• Email Address
• Username
• Salt
• Password Hash

Why the Scale of the 8Tracks Breach Makes It Especially Dangerous

With over 16.5 million accounts exposed, the 8Tracks breach is large enough to appear in nearly every major credential stuffing list used by attackers today. These lists are loaded into automated tools that test millions of email and password combinations against banking sites, email providers, streaming platforms, and corporate login pages. If you reused your 8Tracks password elsewhere and attackers cracked it, every account with that password is at risk of takeover without any further effort on their part.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to the systems that store a website's user data. In the 8Tracks case, the entry point was a developer's GitHub account that lacked two-factor authentication. From there, attackers were able to reach the production environment and copy the user database. This type of attack, known as a supply chain or developer account compromise, is common because developer tools often have broad access to sensitive systems and are not always protected with the same rigor as customer-facing accounts.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records, including the 8Tracks breach. Run a free scan at HEROIC today to find out if your credentials are being cracked or traded right now, and get clear steps to lock down your accounts before attackers get there first.