The AlpineReplay Dump: 686,364 Stolen Email and Password Pairs Online

HEROIC analysts identified the AlpineReplay breach while tracking sports app data being traded on underground forums. The incident occured in August 2019 and exposed 686,364 records from the sports tracking application, including email addresses, bcrypt password hashes, usernames, first names, last names, gender, and birthdays. Despite bcrypt being a stronger hashing method, the sheer volume of accounts and the richness of the personal data made this breach a valuable resource for attackers building identity profiles.

Full Names, Birthdays, and Hashed Passwords Enable Profile-Based Identity Fraud

Even with bcrypt-protected passwords, the combination of full name, email, username, birthday, and gender gives attackers enough detail to impersonate users across services. This data is partcularly useful for synthetic identity fraud, where criminals combine real personal data with fabricated elements to open new accounts or apply for credit. Attackers who successfully crack weaker bcrypt passwords can also launch credential stuffing campaigns across email and financial platforms.

What Was Exposed in the AlpineReplay Breach

• Email Address
• Password Hash
• Username
• First Name
• Last Name
• Gender
• Birthday

Why a Sports App Breach Puts More Than Just Fitness Data at Risk

Sports and fitness platforms collect detailed personal profiles that go well beyond athletic performance. The AlpineReplay breach exposed data that is accessable to fraudsters who can use full legal names, birthdays, and email addresses to target victims with highly personalized phishing messages or attempt to recieve access to linked payment and social accounts. Users who reused their AlpineReplay password on other platforms face particularly elevated risk even years after the breach occured.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a platform's stored user records, usually through exploited vulnerabilities, stolen admin credentials, or insecure server configurations. Once access is established, the attacker exports the user database. The data is then packaged and sold or shared on private forums and dark web marketplaces, where other criminals use it for credential stuffing, phishing, and identity theft.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to show you exactly which of your accounts have appeared in known data breaches. Check now to find out if your AlpineReplay data or credentials from any other breach are already in criminal hands.