APOIA.se Breach Exposes 453,388 Names and Email Addresses

HEROIC analysts identified a data breach affecting APOIA.se, a crowdfunding platform, exposing 453,388 records as of December 16, 2025. The exposed data includes email addresses, first names, and last names. If you have ever supported a creator or cause through this platform, the only way to know for certain if your information was included is to scan your email.

Why Even Basic Details Carry Risk

A real name tied to a verified email address is enough for a scammer to send a convincing, personalized message. On a platform built around giving, that often takes the shape of a fake request to confirm a donation, update payment details, or support a new cause, worded to sound like it is coming from a platform the recipient already trusts.

Account Details Involved In This Exposure

• Email addresses
• First names
• Last names

Why This Is Still Worth Acting On

Even without a password or financial details in the mix, a name and email combination is often all a scammer needs to open the door to a larger social engineering attempt. The goal of these messages is usually to build enough trust to ask for something more valuable later, whether that is a password, a payment, or additional personal information.

How This Kind Of Exposure Happens

In an incident like this one, records are taken directly from a platform's own systems rather than gathered one at a time. HEROIC analysts found this data circulating after it had already been pulled from internal records, reflecting exactly what the platform stored about its users.

Was Your APOIA.se Information Exposed?

Start by scanning your email to see if you are affected. If you are, be cautious of any unexpected message that uses your real name to ask for donation confirmations, payment updates, or further personal details, and verify directly through the platform before responding. This applies equally to personal and work email addresses.