Dark Web Intel: 427,000 Records From the BitRewards Database Dump

HEROIC analysts identified a database breach affecting BitRewards, a Russian e-commerce and cryptocurrency loyalty platform. The breach occured in April 2020 and exposed 427,133 user records. The leaked data included email addresses, phone numbers, bcrypt password hashes, and full names, creating a rich set of personal data that is partcularly useful for targeted phishing and account takeover campaigns.

Email, Phone, and Full Name Together: The Phishing and Fraud Risk

When email addresses, phone numbers, and real names are leaked together, attackers can craft convincing spear-phishing emails and SMS scams tailored to each victim. The combination is accessable to anyone who obtained this database, enabling fraud attempts that are far more believable than generic mass phishing campaigns.

What Was Exposed in the BitRewards Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name

Why an E-Commerce Cryptocurrency Breach Drives Long-Term Financial Fraud

BitRewards operated at the intersection of online shopping and cryptocurrency loyalty rewards. Users who recieved this data have both the personal identifiers and the hashed credentials needed for credential stuffing against crypto wallets, e-commerce accounts, and financial services. Identity theft and financial fraud are the primary outcomes when full names, contact details, and password hashes are bundled together in a single database dump.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to a platform's backend database through vulnerabilities such as SQL injection, exposed APIs, or compromised credentials. Once access is obtained, the attacker exports stored user records and distributes the data through hacking forums or private sales. Even when passwords are hashed with a strong algorithm like bcrypt, the surrounding personal data remains fully readable and immediately usable for social engineering and fraud.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against over 400 billion leaked records, including data from the BitRewards breach. Visit HEROIC to run a free scan and find out if your personal information was exposed.