The Camiseta Criativa Breach: 24,230 Brazilian Passwords Exposed. Yours Might Be One.

HEROIC analysts discovered the Camiseta Criativa breach while monitoring underground forums for Brazilian eCommerce credential data. The breach first appeared in August 2018, when a database from the custom t-shirt platform was posted on a popular hacking forum. A total of 24,230 unique records were exposed, including email addresses and passwords stored in plaintext. No encryption, no hashing. Every password in the file was ready to use the moment the data was downloaded. This kind of basic security failure is exactly what attackers look for when they target smaller eCommerce platforms in emerging markets.

What Attackers Can Do With 24,230 Plaintext Brazilian eCommerce Credentials

Plaintext passwords are a gift to attackers. There is no cracking step, no waiting, no specialized hardware needed. As soon as someone downloads the Camiseta Criativa dataset, they have a working list of real email addresses and the exact passwords those users typed at registration. Attackers imediately test those combinations against Brazilian banking apps, email providers like Gmail and Outlook, social media accounts, and other eCommerce platforms. In a country with a rapidly growing digital payment ecosystem, a working email and password pair is often all that stands between an attacker and a financial account.

What Was Exposed in the Camiseta Criativa Database

• Email addresses
• Plaintext passwords

The dataset contained 24,230 unique records from registered users of the Camiseta Criativa platform. Passwords were stored without any form of hashing or encryption. This means the credentials were fully functional and required no additional processing before being used in attacks. The breach originally contained more records, with deduplication reducing the count to the 24,230 unique pairs confirmed by HEROIC analysts.

Why This Matters for Brazilian Users and Identity Theft Risk

Brazil is one of the most targeted countries for credential stuffing and financial fraud. The combination of a large online user base, high smartphone adoption, and growing digital banking infrastructure makes Brazilian credentials particulary valuable in underground markets. When a plaintext password breach like Camiseta Criativa surfaces, those credentials do not just stay in Brazil-focused combolists. They get merged into global credential collections and tested against international platforms as well. A user who reused their Camiseta Criativa password on their work email or bank account faces real, concrete risk of account takeover and identity theft, even years after the original breach occured.

How a Database Combolist Breach Works

The Camiseta Criativa breach follows the standard database dump and combolist distribution pattern. An attacker gains access to the platform's user database, extracts the relevant fields, and packages the records into a structured file. That file gets shared on hacking forums, either as a standalone post or bundled with credentials from dozens of other breached platforms. Once in circulation, combolists are used by automated credential stuffing tools that test millions of login attempts per day across hundreds of target websites. The fact that Camiseta Criativa stored passwords in plaintext made this file more valuable than the average breach and more likely to be widely shared and reused in the underground community.

Check If Your Camiseta Criativa Credentials Are Still in Circulation

HEROIC's breach intelligence database contains over 400 billion records, including data from the Camiseta Criativa breach and thousands of similar incidents involving plaintext passwords. If you registered on the platform or reused that email and password combination anywhere else, your credentials may still be actively circulating in combolists. Use the HEROIC free breach scanner to check your exposure in seconds. No account required.