The German calltermination Breach Exposed 3,755 VoIP Accounts in 2017

HEROIC analysts discovered the calltermination database circulating on dark web forums in connection with a breach that occured in January 2017. The site, a Germany-based VoIP service platform, had 3,755 user records extracted and leaked, including email addresses, usernames, IP addresses, password hashes, and salts. VoIP service accounts are a particularly attractive target because they sit at the intersection of telecommunications and online services, meaning a compromised account can give attackers access to phone routing, call logs, and billing infrastructure that is seperate from typical consumer accounts.

What Attackers Can Do With Leaked VoIP Account Credentials

A leaked VoIP account is not just a login. It can be a tool for fraud. With access to a calltermination account, attackers can place international phone calls billed to the victim, a crime known as toll fraud that can generate thousands of dollars in charges in a single day. IP addresses in the dataset help attackers identify where users are located, enabling targeted phishing or social engineering. Password hashes, once cracked, give attackers valid credentials that can be reused on email, banking, and communication platforms. The combination of data types in this breach makes it partcularly useful for chained attacks that go well beyond the original VoIP service.

What Was Exposed in the calltermination Breach

• Email Address
• Username
• IP Address
• Salt
• Password Hash

Why a German VoIP Forum Breach Matters to You Globally

The calltermination breach is a reminder that no service is too small to attract attackers. Even a niche VoIP platform with fewer than 4,000 users becomes a target when it holds credentials that can be reused elsewhere. If you registered on calltermination.com and used that email and password combination on other sites, those accounts are at risk right now. Credential stuffing tools are automated and operate at scale, meaning attackers can test millions of password combinations per hour across hundreds of platforms. Identity theft and account takeover are real outcomes from a breach of this kind.

How Database Breaches Work

A database breach happens when an attacker finds a security vulnerability in a web application or server and uses it to extract records stored in the backend database. For sites using forum or VoIP platform software, common attack methods include SQL injection and exploitation of outdated software components. Once the data is extracted, it is packaged as a database dump file and traded or sold in underground markets. In the calltermination case, the breach affected a forum-style platform and exposed the kind of account data attackers most value: email addresses paired with password hashes they can attempt to crack.

Check If Your Data Was Exposed

HEROIC offers a free breach scanner that searches more than 400 billion records, including the calltermination dataset and thousands of other breaches from around the world. Enter your email address now to find out if your data was part of this leak. If it was, change your password on every site where you used the same credentials and turn on two-factor authentication right away.