The BUXP Breach Gave Hackers Ready-to-Use Passwords for 264,367 Users

HEROIC analysts identified a database breach tied to BUXP (buxp.org), a paid-to-click advertising platform, that exposed 264,367 accounts. The breach dates back to April 1, 2016, and the data has continued to circulate on hacking forums and online marketplaces that trade in older breach dumps. The exposed records include email addresses and passwords stored in plaintext.

The BUXP Breach Gave Hackers Ready-to-Use Passwords

Plaintext passwords are the worst-case scenario in a data breach because there is no hashing to crack. An attacker who gets this data has the exact password a person typed in, no extra work required. If any of the 264,367 people affected used that same email and password combination on another site, an attacker can log in immediately, without needing any special tools or technical skill.

What Was Exposed in the BUXP Breach

• Email addresses
• Passwords (stored in plaintext)

Why This Matters for the 264,367 Accounts Involved

A quarter of a million exposed email and password pairs is a large enough set to power serious credential stuffing campaigns. Because these passwords were never protected with hashing, attackers can immediately test them against email providers, banking sites, and shopping accounts. That direct access can lead to account takeover, identity theft, or financial fraud, all stemming from a password originally created for a paid-to-click rewards site.

How a Database Breach Like This Happens

A database breach happens when an attacker gains direct access to the backend storage where a website keeps its user records, rather than targeting individuals one at a time. When a company stores passwords in plaintext instead of using proper hashing, it means the security failure happened well before any breach occurred. Once an attacker gets in, they can export the entire user table in one step, and in this case, every password came out fully readable.

Check If You Are Affected

If you ever had an account with BUXP, or reused that password anywhere else, it is worth checking your exposure right away. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this breach, so you can find out in seconds and change any passwords that need it.