427,133 BitRewards Breach: Emails, Phones Leaked

HEROIC analysts identified a database breach affecting BitRewards, a Russian e-commerce and cryptocurrency loyalty platform. The breach occured in April 2020 and exposed 427,133 user records. The leaked data included email addresses, phone numbers, bcrypt password hashes, and full names, creating a comprehensive personal profile useful for targeted attacks.

Email, Phone, and Full Name Together: The Phishing and Fraud Risk

When email addresses, phone numbers, and real names are exposed together, attackers can craft convincing spear-phishing emails and SMS scams tailored to each victim. The combination is accessible to anyone who obtained this database, enabling fraud attempts that are far more believable than generic mass phishing campaigns. Financial fraud and account takeover follow quickly when threat actors have complete contact information.

What Was Exposed in the BitRewards Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name

Why Crypto Platform Breaches Drive Long-Term Financial Fraud

BitRewards operated at the intersection of online shopping and cryptocurrency rewards. Users who recieved this data have both the personal identifiers and the hashed credentials needed for credential stuffing against crypto wallets, ecommerce accounts, and financial services. Identity theft and financial fraud are the primary outcomes when full names, contact details, and password hashes are bundled together in a single database dump exposed on dark web forums.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access through vulnerabilities such as SQL injection, exposed APIs, or compromised credentials. Once access is obtained, the attacker exports stored user records and distributes the data through hacking forums or private sales. Even when passwords are hashed with strong algorithms like bcrypt, the surrounding personal data remains fully readable and immediately usable for social engineering.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against over 400 billion leaked records, including data from the BitRewards breach. Visit HEROIC to run a free scan and find out if your personal information was exposed in this 427,000-record incident.