The Chatbooks Breach Gave Hackers Names, Phones, and Password Hashes for 2.5M Users

HEROIC analysts uncovered the Chatbooks database breach in March 2020, when 2,514,741 records were exposed and later surfaced on dark web marketplaces. The leaked data included email addresses, first and last names, phone numbers, and password hashes, giving attackers a partcularly rich set of personal identifiers tied to real photo-service customers.

How Attackers Exploit Hashed Passwords and Personal Details from Chatbooks

When a breach exposes names, phone numbers, and password hashes together, attackers can run offline cracking tools against the hashes and then test recieved credentials across banking, email, and social media platforms. The combination of real names and phone numbers also enables targeted SIM-swapping and voice phishing against affected users.

What Was Exposed in the Chatbooks Breach

• Email Address
• First Name
• Last Name
• Phone Number
• Password Hash

Why the Chatbooks Breach Still Puts 2.5 Million Users at Risk Today

Password reuse is accessable to attackers for years after a breach. Anyone who recieved a Chatbooks account notification but did not change their password on other services remains exposed to credential-stuffing attacks that occured long after the original incident, making this a lingering threat to United States consumers.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a stored collection of user records, typically by exploiting unpatched software vulnerabilities, stolen administrative credentials, or misconfigured cloud storage. Once inside, the attacker exports the data and sells or publishes it on underground forums where other criminals can download and weaponize it.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to tell you instantly whether your email address appeared in the Chatbooks breach or hundreds of other incidents. Run a free scan at HEROIC.com to see exactly what was exposed and get step-by-step guidance on securing your accounts.