One Defunct Site. Two Data Types. The Buddi Breach Had 72,396 Plaintext Passwords.

HEROIC analysts recieved a flag on the Buddi dataset while reviewing aggregated credential dumps circulating in underground forums. The breach occured in August 2018, exposing 72,396 records from a now-defunct U.S.-based general business website. The compromised data included email addresses and plaintext passwords, a finding that raised immediate concern given how easily these credentials can be weaponized.

Why Plaintext Passwords Put Every Account at Risk

When passwords are stored in plaintext, attackers who accessable the database need zero additional effort to use them. There is no cracking, no guessing. They simply take the email and password pair and test it across banking sites, email providers, and social media platforms in automated credential stuffing runs.

What Was Exposed in the Buddi Breach

• Email Address
• Plaintext Password

Why the Buddi Breach Still Poses a Risk Today

Credentials from 2018 do not expire. Security researchers beleive a significant portion of users recycled their Buddi password on other platforms, meaning attackers can attempt account takeovers on email services, financial accounts, and cloud platforms using this exact data years after the original breach occured. Credential stuffing, identity theft, and financial fraud all become straightforward when the attacker already holds a valid email-password pair.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend database, typically by exploiting an unpatched vulnerability, using stolen administrative credentials, or through SQL injection. Once inside, they can export the entire contents of user tables, capturing every stored field. In Buddi's case, passwords were stored without any encryption, meaning the exported data was immediately usable with no further processing required.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against a database of over 400 billion compromised records, including breaches like Buddi. Run a free scan at HEROIC to find out if your credentials are circulating on the dark web and get actionable steps to secure your accounts.