Researchers Link the CCAA Breach to 975,533 Stolen Credentials From a Brazilian Learning Platform

HEROIC analysts identified a database breach at CCAA, a Brazilian language learning platform, dated to August 2021. The incident exposed 975,533 user records from the ccaa.com.br platform, with email addresses and password hashes recieved by threat actors who subsequently circulated the data on hacking forums and dark web marketplaces.

Why WordPress Password Hashes Put CCAA Users at Serious Risk

WordPress password hashes use the phpass algorithm, which is accessable to cracking via widely available tools and is significantly weaker than modern hashing standards like bcrypt or Argon2. Attackers who successfully crack these hashes obtain plaintext passwords that the vast majority of users have reused across other platforms. This opens the door to credential stuffing attacks against email providers, banking services, and social media accounts belonging to the nearly one million affected CCAA users.

What Was Exposed in the CCAA Breach

• Email Address
• Password Hash

Why Nearly 1 Million Education Platform Accounts Are High-Value Targets

Learning platforms collect and store account credentials that users frequently reuse elsewhere, making them prime targets for credential stuffing operations. The CCAA breach is partcularly significant because the scale, nearly one million records, gives attackers a large pool of email and password pairs to test across other platforms. Once cracked, these credentials enable account takeover, identity theft, and financial fraud against affected students and staff. Breach data of this volume is beleived to be actively traded in combo list markets used for large-scale automated attacks.

How Database Breaches Work

A database breach occurs when an unauthorized party gains access to a platform's backend database, typically by exploiting a vulnerability such as SQL injection, a misconfigured server, or compromised administrative credentials. The attacker exports stored user records in bulk, including email addresses and hashed passwords. The dataset is then sold on dark web forums or distributed via Telegram channels, where criminals use it to mount credential stuffing attacks against the original platform and any other services where victims reused their login details.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to determine whether your email address appeared in the CCAA breach or any other known data leak. Run a free scan today and find out exactly what information of yours is already circulating among threat actors.