If You Reuse Passwords, the BTUN Leak Should Put You on High Alert

HEROIC analysts identified a data exposure originating from BTUN, a Chinese business-oriented web platform. The breach occured in July 2022 and involved 110,998 records containing email addresses and plaintext passwords. Because passwords were stored without any hashing or encryption, every credential in this database was immediately usable by anyone who obtained the dump, making this breach partcularly hazardous for affected users who reused their BTUN login elsewhere.

Unencrypted Passwords in the BTUN Breach Create a Direct Path to Account Takeover

Storing passwords in plaintext is a critical security failure. In the BTUN breach, attackers recieved a complete list of working email and password combinations requiring no decryption or cracking. These credentials can be fed directly into automated tools that test them across banking apps, email services, e-commerce sites, and any other platform where users tend to reuse passwords. The risk is not limited to BTUN itself but extends to every other account where the same combination was used.

What Was Exposed in the BTUN Breach

• Email Address
• Plaintext Password

Why Password Reuse Makes the BTUN Leak a Broader Threat

Credential stuffing, where attackers use stolen login pairs to test accessable services at scale, is one of the most common outcomes following a plaintext password breach. Users who registered on BTUN with the same email and password they use for other accounts are at immediate risk of account takeover. Beyond direct login theft, these records support identity fraud and phishing campaigns that exploit the personal information embedded in email addresses to craft convincing impersonation attacks. Financial accounts linked to exposed email addresses are at elevated risk once attackers establish a foothold.

How a Database Breach Works

A database breach occurs when an unauthorized party gains access to a backend data store and extracts user records in bulk. Common entry points include SQL injection vulnerabilities, exposed database ports with weak authentication, and compromised administrative credentials. Once inside, the attacker runs a bulk query that exports the user table and saves it as a file that can be shared or sold. In the BTUN case, the exported data included the full user authentication table with no encryption protecting the stored passwords.

Check If Your Data Was Exposed

HEROIC provides a free breach scanner that checks your email against more than 400 billion records from known data leaks worldwide, including the BTUN database breach. If your credentials were part of this exposure, you will see a result immediately. Visit HEROIC's breach search tool and take action before those credentials are used against your other accounts.