ClickReforma: 29,328 Brazilian Home Renovation Accounts Breached (2018)

Home Renovation Platform, Home Address Data: ClickReforma's 29,328-Record Breach

When a home renovaton marketplace is breached, attackers don't just get email addresses and passwords -- they get a window into users' physical homes. ClickReforma, a Brazilain platform connecting homeowners with renovation contratcors, exposed 29,328 accounts in a breach released on August 26, 2018. The email and password data entered the combolist ecosystem, but the context of the breach is what elevates its risk: users of contractor marketplaces typically provide home addresses, project scopes, and renovation budgets as part of the service.

ClickReforma (Aug 26, 2018): Breach Summary

• Records Exposed: 29,328
• Data Types: Email addresses, MD5 password hashes
• Breach Type: Database breach
• Country Affected: Brazil
• Date Leaked: August 26, 2018

Contractor Marketplace Data: More Than Just Credentials

Home renovation platforms occupy a unique position in the breach risk hierarchy. Unlike a gaming forum or music site, a contractor marketplace requires users to submit their home address, describe their property, outline their renovation needs, and often indicate a budget range. Even if ClickReforma's database only directly exposed email addresses and password hashes, the associated user profiles likely contained physical location data tied to each account. Attackers who cracked the MD5 hashes and confirmed active accounts had both a set of working credentials and a potential mapping between email identities and residential addresses -- a combination that goes well beyond what most consumer credential breaches produce.

MD5 Passwords: The Familiar Weakness Behind the August 26 Cluster

ClickReforma joins a long list of platforms in the August 26, 2018 breach cluster that stored user passwords using MD5 hashing -- a method deprecated for password storage long before 2018. MD5 without salting is reversible through rainbow table lookups in seconds, and even salted MD5 is substantially weaker than modern alternatives like bcrypt or Argon2. The cracked passwords from ClickReforma's 29,328 accounts fed directly into credential stuffing lists targeting Brazilian banking portals, social platforms, and eCommerce sites -- markets where password reuse across accounts is common.

Brazil in the August 26, 2018 Global Combolist

ClickReforma is the only Brazilian platform confirmed in the August 26, 2018 combolist cluster, which otherwise spans the United States, United Kingdom, India, Indonesia, Japan, and Russia. Its inclusion demonstrates that the aggregator operating this cluster sourced data from markets across at least five continents, compiling regionally diverse breach data into a single unified release. For Brazilian users specifically, this breach arrived alongside a period of broader cybersecurity pressure on local platforms -- a context in which local credential leaks were increasingly being cross-referenced against international banking and payment platforms accessed by Brazilian consumers.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to tell you instantly if your email appears in the ClickReforma breach or any other known data leak. If you used ClickReforma or any Brazilian home services platform with a password you've reused elsewhere, search your email now -- your credentials may have been in active circulation since 2018.