The Artrookie Dump Holds Exactly 1,248 Emails and Base64 Passwords

HEROIC analysts identified a breach connected to Artrookie, a UK-based shopping site at artrookie.com, that exposed 1,248 user records. The breach dates back to December 6, 2015, and the exposed data includes email addresses, usernames, and passwords encoded in Base64.

Why the Artrookie Breach Is More Dangerous Than It Looks

Base64 is not encryption and it is not a real password hash, it is simply a way of encoding text so it can be stored or transmitted as plain characters. Anyone who finds this data can decode the passwords back to their original, readable form in seconds using free online tools. That means the 1,248 passwords in this breach should be treated as if they were stored in plain text, fully readable by anyone who gets access to the file.

What Was Exposed in the Artrookie Breach

• Email addresses
• Usernames
• Passwords (Base64 encoded, easily reversible)

Why This Matters for Artrookie Shoppers

Because these passwords can be decoded instantly, attackers can immediately try the email, username, and password combinations against other websites, a tactic known as credential stuffing. If you shopped at artrookie.com and reused that password anywhere else, whether it's your email, a banking app, or a social media account, that account could be compromised the moment someone runs this list through automated login tools.

How a Database Breach Like This Happens

A database breach like this typically starts with attackers exploiting a vulnerability in a website's code or server configuration to gain direct access to the customer database. From there, they export the entire table of usernames, emails, and passwords, and post the file on a hacking forum for others to use or trade. Because Artrookie stored passwords with weak, reversible encoding instead of a proper cryptographic hash, this breach was especially easy for attackers to weaponize the moment it leaked.

Check If You Are Affected

Breaches like this one often go unnoticed by the people affected for years, even as the data keeps circulating. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this one, so you can find out in seconds whether your information was exposed and change any reused passwords before someone else does.