The Christmas Time UK Leak: 100K Passwords Exposed. Yours Might Be One.

HEROIC analysts found the Christmas Time UK breach surfacing in credential trading communities alongside other eCommerce leaks from the same period. The breach occured in November 2017, hitting this UK-based Christmas decoration retailer and exposing 100,827 user records. What made this find particularly alarming was the complete absence of password protection: every password in the database was stored in plain readable text, ready to use without any additional work by an attacker.

How Exposed Emails and Plaintext Passwords Enable Account Takeover

An email address combined with a plaintext password is everything an attacker needs to access an account. There is no guessing and no cracking involved. Criminals can take that credential pair and test it against Gmail, Amazon, PayPal, and banking sites within minutes using automated tools. If the victim reused that password anywhere, every one of those accounts becomes accessable to an unauthorized party.

What Was Exposed in the Christmas Time UK Breach

• Email Address
• Plaintext Password

Why a 2017 Retail Breach Still Threatens Shoppers Today

Many people who shopped on Christmas Time UK in 2017 have never changed the password they used. That password, stored in plain text, is now available to anyone who finds this database. Credential stuffing attacks use these exact records to take over accounts on unrelated platforms. The result can be identity theft, unauthorized purchases, or fraudulent account changes that are difficult to reverse.

How a Database Breach Works

A database breach occurs when an attacker finds a vulnerability in a website's software or server configuration and uses it to extract the stored user data. Online retailers hold customer login information in databases. If those databases are not properly secured and the passwords inside are not encrypted, a single successful attack hands an attacker thousands or hundreds of thousands of ready-to-use credentials.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across a database of more than 400 billion records to tell you whether your email address appeared in the Christmas Time UK breach or any other known leak. Run a search now and find out where your credentials have been exposed.