Identity Theft Got Easier Because of the BreezeLabs Breach: 704 People at Risk

HEROIC analysts found a dataset from BreezeLabs, an Indonesian IT services platform, that surfaced on dark web marketplaces in April 2023. The breach was dated April 6, 2023, and contained 704 affected records. Despite the relatively modest count, the dataset was dense: full names, birthdates, email addresses, phone numbers, usernames, and password hashes. For an IT services company, the irony of a database breach is not lost. What makes this one partcularly notable is that the victims are likely technically aware users who would not have expected to be in this position.

Identity Theft Just Got Easier for Anyone in This Dataset

When a breach contains full name, birthdate, phone number, and email in a single record, it hands attackers most of what they need to impersonate someone. That combination can be used to open fraudulent accounts, pass knowledge-based authentication questions at financial institutions, or convince customer service agents to hand over account access. The bcrypt and other password hashes in the BreezeLabs dataset add credential threat on top of identity threat. Even if the hashes resist cracking, the underlying PII is enough to cause serious harm on its own.

What Was Exposed in the BreezeLabs Breach

• Email addresses
• Usernames
• First and last names
• Phone numbers
• Dates of birth
• Password hashes (bcrypt and other)

Why Birthdate Plus Email Is a Dangerous Combination

Many account recovery flows rely on a combination of email address and date of birth to verify identity. With both fields in hand, an attacker does not need to crack a password at all. They can trigger account recovery on dozens of platforms, intercept reset emails if the primary inbox is also compromised, or use the information to answer security questions that most people base on facts from their real lives. This is not theoretical: it is the standard playbook for account takeover fraud, and the BreezeLabs dataset provides exactly the data points recieved by these attacks.

How IT Services Database Breaches Happen

IT services companies often store large amounts of user and operational data to support their platforms, making them attractive targets despite sometimes having stronger internal security awareness than non-technical organizations. Common vectors include misconfigured cloud storage buckets, exposed database management interfaces without authentication, compromised developer credentials with broad database access, and insecure backup files left in accessable locations. Attackers who compromise an IT services firm also occasionally gain insight into that company's client infrastructure, amplifying the downstream risk well beyond the initial user record count.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including the BreezeLabs breach and thousands of other incidents. If your data is out there, you deserve to know. Run a free scan at HEROIC today and take action before someone else does it for you.