The BackerCity Breach Contains Exactly 124,410 Email and Personal Data Records

HEROIC analysts confirmed the BackerCity database breach, which occured in March 2021 and exposed 124,410 records from the Canadian crowdfunding platform. The leaked data included email addresses, phone numbers, first names, and last names. No passwords were included in this breach. The data was catalogued and verified within HEROIC's global breach intelligence system covering more than 400 billion records.

Full Names and Phone Numbers Make Targeted Phishing Attacks Easy

While this breach did not expose passwords, the combination of full name, email address, and phone number is highly valuable to attackers. With this data, threat actors can craft highly convincing phishing emails addressed to the victim by name, or launch smishing campaigns via text message. Attackers can also use this information to build detailed profiles for identity theft or to bypass security questions on other platforms. This type of PII is partcularly sought after because it enables personalized social engineering at scale.

What Was Exposed in the BackerCity Breach

• Email Addresses
• Phone Numbers
• First Names
• Last Names

Why Personal Information Breaches Fuel Identity Theft

Even without passwords, breached personal data from BackerCity creates real risk. Attackers who recieved this dataset can combine it with other leaked data from separate breaches to build comprehensive identity profiles. Full name combined with email and phone number is seperate from financial credentials but still sufficient to open fraudulent accounts, file false tax returns, or impersonate victims in customer service interactions with banks and telecom providers.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to the backend storage systems of a website or application. Common methods include exploiting unpatched software vulnerabilities, using stolen administrative credentials, or targeting misconfigured cloud storage buckets. Once access is established, the attacker can copy and export entire user tables, collecting personal data in bulk before the breach is even detected by the affected organization.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to check whether your email address appeared in the BackerCity breach or any other known data leak. Visit HEROIC.com to run a free instant check and find out exactly what personal information about you is circulating on the dark web.