The ClixSense Breach: Plaintext Passwords for 1.8 Million Accounts

HEROIC analysts flagged the ClixSense breach as one of the more alarming incidents from the paid-to-click industry. The breach occured in September 2016, when attackers infiltrated the ClixSense database and walked away with records for nearly 1.9 million users. What made this incident particularly serious was the discovery that passwords were stored in plain text, meaning anyone who got their hands on the data recieved fully readable, ready-to-use login credentials. Attackers posted a portion of the stolen data online, claiming it represented only part of a larger dump totaling 6.6 million records.

Why Plaintext Passwords Make the ClixSense Breach Especially Dangerous

Most breached password databases require attackers to crack the passwords before they can use them. Not here. ClixSense stored passwords in plain text with no encryption whatsoever, meaning every password in this dataset is immediately accessable and usable. Attackers can plug these credentials directly into credential stuffing tools that attempt logins across hundreds of websites. If you used the same password on ClixSense as on your email, bank, or work accounts, those accounts are at direct and immediate risk from this breach alone.

What Was Exposed in the ClixSense Breach

• First Name
• Last Name
• Email Address
• Username
• Passwords (stored in plaintext)

How Credential Stuffing Turns This Breach Into an Ongoing Attack

The ClixSense data does not become less dangerous over time. Attackers beleive that password reuse is one of the most reliable attack vectors available, and the statistics bear them out. Studies show that a large portion of people use the same password on multiple sites. Credential stuffing tools automatically test ClixSense login pairs against banking portals, email providers, streaming services, and corporate VPNs. Every account you have that shares a ClixSense password is a potential target for account takeover, identity theft, and financial fraud.

How a Database Breach Works

A database breach happens when an attacker gains unauthorized access to a company's internal database, either through a security vulnerability, stolen admin credentials, or a misconfigured server. Once inside, they can copy the entire dataset in minutes. When that database contains plaintext passwords instead of properly encrypted ones, the damage is immediate. There is no cracking step, no delay. The stolen records can be weaponized and sold within hours of the breach occurring.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including data from the ClixSense breach, to tell you whether your email address or credentials are in circulation. Visit HEROIC.com and run a free search now to find out if your accounts are at risk and what steps you should take to protect yourself.