6,865,195 Aptoide Breach: App Store Passwords Leaked

HEROIC analysts uncovered the Aptoide breach in April 2020, exposing 6,865,195 user records from the Portugal-based Android app store. The leaked dataset, which later recieved renewed attention on underground forums, contained email addresses and plaintext passwords stored without any encryption protections.

Why Plaintext Passwords Make the Aptoide Breach Especially Dangerous

With both email addresses and plaintext passwords compromised, attackers can immediately attempt login into any service where victims reused those credentials. This type of credential stuffing is partularly effective because password reuse across platforms remains extremely common. One leaked email and password pair can potentially unlock dozens of different user accounts.

What Was Exposed in the Aptoide Breach

• Email Address
• Plaintext Password

Why App Store Breaches Have Extended Threat Lifespans

Breaches involving plaintext passwords have unusually long shelf lives on dark web markets. Threat actors continually recycle and repackage older datasets for resale. If affected users have not changed their passwords or still use the same credentials elsewhere, their accounts remain accessible to anyone who purchases this data on dark web marketplaces or breach forums.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to backend infrastructure through SQL injection, misconfigured cloud storage, or compromised admin credentials. The attacker then copies or exports stored user records including account details and passwords, distributing them through illicit channels for profit or recognition.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to check whether your email address appeared in the Aptoide breach or any other known data leak. Run a free scan today to find out what data of yours is circulating online and exposed to threat actors.