If You Used RootsWeb, the Ancestry Breach Should Worry You Now

HEROIC analysts identified a breach connected to Ancestry, tied to its RootsWeb service, that exposed 297,771 user records. The breach dates back to November 7, 2015, though it went undetected for roughly two years before a file containing the data was discovered circulating online. The exposed data set includes email addresses, first names, last names, and passwords stored in plaintext.

Why This Breach Should Worry You If You Used RootsWeb

Storing passwords in plaintext means there was no hashing protecting them at all. Anyone who obtained this file could read every password exactly as it was typed, with no cracking required. Combined with a real first name, last name, and email address, that gives attackers an immediately usable login plus enough personal detail to craft a convincing, personalized phishing message.

What Was Exposed in the Ancestry RootsWeb Breach

• Email addresses
• First names
• Last names
• Passwords (stored in plaintext)

Why This Matters for RootsWeb and Ancestry Users

If you used RootsWeb and reused that password on your email, banking, or other accounts, this breach could still put those accounts at risk today. Because the passwords require no cracking, attackers can plug them directly into automated credential stuffing tools. The full names paired with emails also make this data useful for targeted phishing, since a message that uses your real name is far more convincing than a generic scam attempt.

How a Plaintext Password Breach Goes Undetected for Years

A plaintext password breach happens when a website stores user passwords exactly as entered, without any cryptographic hashing. In this case, the breach occurred in 2015 but was not discovered until roughly two years later, when a file containing the stolen data began circulating online. That gap between compromise and discovery meant the exposed credentials could have been used against victims for years without anyone knowing the data had been stolen in the first place.

Check If You Are Affected

With nearly 300,000 plaintext passwords exposed, this breach remains a serious risk for anyone who reused their RootsWeb password elsewhere. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this one, so you can find out in seconds whether your information was exposed and change any reused passwords immediately.