The canwatchco Breach Gave Hackers Passwords to Raid Your Other Accounts

HEROIC analysts identified the canwatchco breach as a database exposure that occured in January 2017, surfacing credentials from 3,124 customer accounts. The leaked data includes email addresses, usernames, password hashes, and salts from what was once a small online watch retailer based in Switzerland. Though the record count is modest, the combination of email addresses paired with crackable password hashes makes this dataset partcularly useful to attackers running credential stuffing campaigns across larger platforms.

How Hackers Use Hashed Passwords to Break Into Your Accounts

When attackers get hold of a database containing password hashes and salts, they run those hashes through cracking tools that test billions of password combinations per second. Once a password is cracked, they have your actual login credential. They then take your email and password and try it on Gmail, Amazon, PayPal, banking apps, and dozens of other sites. This process is automated and accessable to even low-skilled criminals using off-the-shelf hacking software. The canwatchco breach gives attackers exactly what they need to attempt these logins at scale.

What Was Exposed in the canwatchco Breach

• Email Address
• Username
• Salt
• Password Hash

Why a 2017 Breach Still Puts You at Risk Today

Old breaches do not expire. Attackers regularly revisit leaked databases from years past because most people never change their passwords after a breach they did not know about. If your canwatchco credentials are the same ones you use for your email or bank account, you are still vulnerable right now. Credential stuffing, account takeover, and identity theft cases tied to breaches this old are not uncommon. Cybercriminals trade and resell these databases repeatedly, meaning new threat actors gain access to the data long after the original breach occured.

How Database Breaches Work

A database breach happens when an attacker finds a weakness in a website or application and extracts data stored in its backend database. This is often done through a technique called SQL injection, where the attacker tricks the database into handing over its contents. Once the data is pulled, it is usually compressed into a dump file and shared or sold on hacking forums and dark web marketplaces. The website owner may not notice for months or even years. In the canwatchco case, the breach dates back to 2017, meaning affected users went years without knowing their data was out there.

Check If Your Data Was Exposed

HEROIC offers a free breach scanner that searches across more than 400 billion records, including the canwatchco database and thousands of other breaches. Enter your email address to find out if your credentials have been exposed and get guidance on what to do next. Do not wait for another breach to find out your password has been compromised.