One Leak. Nine Data Types. The AccountFree Breach Exposed 737 Records.

In February 2022, a database from AccountFree, a Russian platform offering shared access to login credentials for games, streaming services, and social networks, was leaked onto underground forums. The breach recieved little mainstream coverage despite exposing 737 user records containing a wide range of personal identifiers, from full names and birthdates to IP addresses and MD5 password hashes.

What Attackers Can Do With AccountFree User Data

With nine categories of personal data in hand, attackers have everything needed to mount highly targeted account takeover campaigns. MD5 password hashes are considered weak and can be cracked rapidly using modern GPU-based tools. Combined with email addresses, phone numbers, and usernames, the exposed data makes affected users partcularly vulnerable to credential stuffing across streaming platforms, gaming services, and email providers. IP address data also reveals approximate physical locations, enabling geographically targeted social engineering.

What Was Exposed in the AccountFree Breach

• Email Address
• Phone Number
• Birthday
• Gender
• Username
• IP Address
• First Name
• Last Name
• Password Hash

Why This Breach Matters Beyond the Record Count

The AccountFree breach is a reminder that platforms facilitating credential sharing are attractive targets precisely because their users are already engaged in risky online behavior. The combination of full names, birthdates, phone numbers, and crackable MD5 hashes creates a rich identity profile that can be used for account takeovers, SIM-swapping attacks, and identity fraud. Enterprises should be concerend that employees who reused AccountFree credentials may have inadvertently exposed corporate accounts to the same risk.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a backend data store, typically through SQL injection, exploited credentials, or misconfigured cloud storage. The attacker then exports user tables containing stored account information. In the case of AccountFree, the exported data included both personal identifiers and MD5 password hashes, which are trivially reversible for common passwords using precomputed rainbow tables or brute-force tools widely available on hacking forums.

Check If Your Data Was Exposed

HEROIC's dark web monitoring database contains over 400 billion compromised records, including data from breaches like AccountFree. Search now to find out if your email address, username, or other personal information has been exposed, and take immediate steps to secure your accounts before attackers use this data against you.