Who Is in the aloe-vera-beaute.com Clients File? 3,541 Logins

Anyone who signed up as a client on aloe-vera-beaute.com should know that a clients table from the site leaked 3,541 plaintext logins, logged by HEROIC analysts in a December 2020 combolist file. Each record pairs an email address with a readable password and a URL pointing back to the account it belongs to.

Why a client record is especially useful to an attacker

A clients table tends to hold active, real accounts rather than test data, which means the credentials inside it are more likely to still be in use, and more likely to be tried successfully elsewhere by whoever picks up the file next.

What was exposed

• Email addresses, identifying each client account in the table
• Plaintext passwords, usable immediately without cracking
• URLs, pointing to the exact login page tied to each credential

Why client accounts on this list matter

If the password attached to your email in this table matches one you use elsewhere, this exposure isn't limited to your aloe-vera-beaute.com account. It follows the password wherever it's been reused, which is why a leak from a single site's client list can end up affecting accounts on entirely different platforms.

How a table like this ends up in a combolist

Someone extracts records from a site's own client data and folds them into a larger combolist alongside credentials pulled from other sources, building one file meant for repeated login attempts across many platforms and services.

Not sure if you were a client on the list?

A free scan your email will check your email against this exposure and every other HEROIC tracks. If you're a match, change that password now, update it anywhere else you've reused it, and turn on two factor authentication where it's offered. This applies whether the account uses a personal or work email address.