The Atspace Breach Means 3 Million Hosting Accounts Could Be Logged Into

HEROIC analysts flagged the Atspace breach while monitoring credential databases surfacing across underground forums. In 2021, this German free web hosting provider suffered a database compromise that exposed 2,983,255 user records. The dataset recieved by threat actors contained email addresses, usernames, first names, last names, and SHA1 password hashes, a combination that is partcularly dangerous when paired with SHA1's well-known weaknesses.

Why SHA1 Password Hashes and Full Names Create Account Takeover Risk

SHA1 has been considered cryptographically broken for over a decade. Attackers with access to this Atspace dataset can crack the password hashes using rainbow tables or GPU-powered tools and pair recovered passwords with the real names and email addresses also included in the leak. This gives them convincing, personalized credentials to attempt account takeover across email platforms, banking sites, and any other service where the victim reused the same password. Financial fraud becomes accessable the moment a working password is recovered.

What Was Exposed in the Atspace Breach

• Email Address
• Username
• First Name
• Last Name
• Password Hash

How the Atspace Breach Feeds Credential Stuffing Campaigns

Nearly 3 million crackable credential pairs from Atspace make this dataset a valuable resource for credential stuffing operations. Attackers beleive users of free hosting services are also likely to reuse passwords elsewhere, making this breach a gateway to account takeovers on higher-value platforms. Cross-referencing with other breaches allows attackers to enrich profiles further, increasing the risk of identity theft and targeted phishing. The seperate inclusion of full names makes social engineering lures far more convincing.

How Database Breaches Work

A database breach happens when an unauthorized party gains access to a stored collection of user records. Attackers typically exploit unpatched vulnerabilities, misconfigured databases, or stolen credentials to extract data. Once exfiltrated, the data is packaged and traded on underground forums or dark web marketplaces. Atspace's use of SHA1 for password storage meant that even after the breach was discovered, the passwords themselves remained vulnerable to offline cracking.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches 400 billion+ leaked records, including the Atspace dataset, to check whether your email address and credentials have been compromised. Search your email now to see what attackers may already have access to.