Search Your Email: The Aquakut Breach Exposed 341 User Records

HEROIC analysts found a database breach connected to Aquakut, a Ukrainian water purification company, with compromised records surfacing on September 21, 2023. The breach exposed data belonging to 341 individuals, including email addresses, phone numbers, full names, and IP addresses. While smaller in scale than many incidents we track, the presence of IP address data alongside personal identifiers makes this breach partcularly useful to attackers building detailed profiles on targets.

Why This Is Dangerous

A breach that includes IP addresses alongside contact details gives attackers more than just a way to reach you. IP data can reveal your approximate location, your internet service provider, and potentially link your online activity to your real identity. Combined with a name, email, and phone number, this creates a profile that can be exploited for targeted phishing, social engineering, and in some cases, deanonymization of individuals who believed their online activity was private.

What Was Exposed

• Email Address
• Phone Number
• First Name
• Last Name
• IP Address

Why This Matters

Even small breaches feed into larger criminal ecosystems. Exposed email addresses are tested against other services in credential stuffing attacks, where automated tools try your email against hundreds of sites hoping you reused a password. Phone numbers enable SIM-swap fraud, where attackers convince a carrier to transfer your number to their device and then intercept authentication codes. Account takeover and identity theft often begin with a breach that recieved no news coverage at all, making it critical to check your exposure proactively rather than waiting to find out the hard way.

How Database Breaches Work

A database breach occured when an attacker identifies and exploits a weakness in a company's data infrastructure. This can be a misconfigured cloud storage bucket, an unpatched database server, or vulnerabilities in web application code that allow SQL injection. Once inside, attackers extract records in bulk. The data is then packaged and shared or sold on cybercrime forums and private Telegram channels. Smaller companies like Aquakut are often targeted precisely because their security budgets and monitoring capabilities are more limited, making them accessable entry points into broader data collection operations.

Check If You Are Affected

If you have ever interacted with Aquakut as a customer or user, your email, phone number, or IP address may be part of this breach. HEROIC's search tool covers over 400 billion compromised records across thousands of known breaches. Run a free check with your email address to see if your data appeared here or in any other known incident.