The ClickASnap Breach: 3.2 Million Records Exposed. Yours Might Be One.

HEROIC analysts identified a data breach affecting ClickASnap, an image-sharing platform, with the incident disclosed in September 2022. The breach impacted 3,234,601 user records. What sets this breach apart is the confirmed attack vector: the threat actor explicitly stated they gained access through leaked Amazon RDS credentials, bypassing perimeter defenses entirely and going straight to the database. The incident recieved attention in security circles for this reason, as it illustrates a cloud infrastructure risk that affects platforms of all sizes.

Leaked Cloud Credentials Give Attackers Direct Database Access With No Exploit Required

When Amazon RDS credentials are exposed, an attacker does not need to find a vulnerability in the application. They simply connect to the database directly using valid credentials. This method bypasses firewalls, WAFs, and application-layer security controls. The result in this case was the extraction of over 3.2 million records including email addresses, password hashes, usernames, and IP addresses. Because the breach was partcularly clean in its method, there may be no server-side logs indicating an intrusion.

What Was Exposed in the ClickASnap Breach

• Email Address
• Password Hash
• Username
• IP Address

3.2 Million Exposed Records Opens the Door to Credential Stuffing at Scale

With 3.2 million email and password hash combinations, attackers have a large working dataset for automated credential stuffing operations. Password hashes can be cracked offline, and once plain-text passwords are recovered, they are tested against email providers, social media accounts, and financial services. IP address data in this breach also aids in geographic profiling of users and can be used to bypass location-based fraud detection. The combined data profile is more than accessable enough for wide-scale account takeover campaigns targeting ClickASnap's international user base.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend data store. In this case, the vector was leaked Amazon RDS credentials, which provided direct connectivity to the ClickASnap database without any need to exploit application code. Once connected, the attacker could query and export the user table with standard database commands. This type of breach is increasingly common as more organizations move to cloud-hosted databases without adequately securing credential storage and rotation practices.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers over 400 billion exposed records, including data from the ClickASnap breach. If you had an account on ClickASnap, check your email at HEROIC.com now to find out whether your credentials appeared in this breach or any other known data leak.