25K BigBonuses Breach: Plaintext Passwords Exposed

HEROIC analysts identified a data breach at BigBonuses, a United States-based eCommerce platform, that occurred in August 2018. The breach exposed approximately 25,450 user records containing email addresses and passwords that were stored in plaintext with no encryption whatsoever. This type of storage failure means anyone who got hold of the database could read every password immediately, no technical skills required. The data has been circulating in underground markets and breach aggregation sites since the incident first surfaced.

How Exposed Email and Plaintext Passwords Enable Instant Account Takeovers

With a ready-made list of email and plaintext password pairs, attackers do not need to do any additional work to start breaking into accounts. They can feed the leaked credentials directly into automated tools that test them against popular platforms like Gmail, Amazon, PayPal, and banking apps. This attack method, known as credential stuffing, works because a large portion of people use the same password on multiple sites. A single exposed record from BigBonuses could give an attacker access to far more valuable accounts the victim holds elsewhere.

What Was Exposed in the BigBonuses Breach

• Email Address
• Plaintext Password

Why Plaintext Password Leaks Threaten More Than Just One Account

The real danger of a plaintext password breach is the chain reaction it can trigger. Once an attacker has your email and password, they can attempt to access your email account itself. From there, they can reset passwords on any other service tied to that email, effectively locking you out of your own accounts. This cascade of account takeovers can lead to financial fraud, identity theft, and months of cleanup. The separate problem of password reuse across the internet means one small breach can produce very large consequences.

How Database Breaches Work

A database breach happens when an unauthorized person gains access to a company's backend data storage. Attackers commonly exploit vulnerabilities in web applications, outdated server software, or weak administrative credentials to get in. Once inside, they can silently copy the entire database without the company noticing for days, weeks, or even months. Smaller eCommerce sites often run without dedicated security monitoring, making them attractive and easy targets. The stolen data is then sold, shared, or posted publicly on dark web forums where it can be used repeatedly.

Check If Your Data Was Exposed

If you ever shopped or had an account on BigBonuses, your email and password may already be in the hands of attackers. HEROIC's free breach scanner checks your information against a database of more than 400 billion exposed records so you know exactly where you stand. Run your free scan today and find out if your credentials are at risk.