The CO.SI.ME Breach Data Quietly Appeared on the Dark Web With 14,000 Plaintext Passwords

HEROIC analysts identified a database breach affecting CO.SI.ME, an Italian manufacturer of explosion-proof electrical equipment serving the chemical and petrochemical industries. The breach was recorded on January 24, 2025, and involved the extraction of approximately 14,330 records from what appears to be a customer or employee database. The exposed data includes email addresses, phone numbers, first names, and passwords stored in plaintext. For a company operating in high-risk industrial environments, this is a particularly consequential exposure.

What Makes This Breach Unusual for an Industrial Company

CO.SI.ME serves clients in the chemical and petrochemical sectors, industries where the people in the database are not typical retail consumers. They are engineers, procurement officers, site managers, and technical staff at facilities that handle hazardous materials. When that kind of contact list is exposed alongside working plaintext passwords, the risk extends beyond the individual accounts. Attackers who can identify which organization a person works for and obtain their login credentials are in a position to target that organization directly, through phishing, social engineering, or by testing those credentials against corporate systems.

What Was Exposed in the CO.SI.ME Data Breach

• Email addresses
• Phone numbers
• First names
• Plaintext passwords

The plaintext storage of passwords indicates that CO.SI.ME was not applying standard password hashing practices. Anyone who accessed this database before discovery had immediate access to working credentials, with no need for any cracking or decryption.

Why This Matters: Industrial Contacts, Identity Theft, and Account Takeover

Combining a name, email address, and phone number creates a profile ready-made for phishing. Add a working password and the attacker does not need to construct a convincing scam, they simply log in. Phone numbers also enable SIM-swapping attacks, where a threat actor convinces a mobile carrier to transfer the victim's number, bypassing SMS-based two-factor authentication on banking and email accounts. For individuals connected to industrial or critical infrastructure organizations, the downstream consequences of account takeover can extend well beyond personal financial loss.

How a Database Breach Exposes Records Like These

A database breach of this type typically occurs when an attacker finds an exposed or poorly secured backend database, exploits a vulnerability in the web application layer to extract records, or gains access through a compromised administrative account. Once inside, extracting 14,000 records takes seconds. The resulting file is then shared on dark web forums or private channels. What distinguishes this incident is the plaintext password storage, which suggests that CO.SI.ME's database was not built with modern security practices. Had passwords been hashed using a standard algorithm, attackers would have faced a significant additional barrier before gaining usable credentials.

Check If Your Information Appears in This Breach

If you have ever interacted with CO.SI.ME through their website, placed an order, or registered for their services, your contact information and password may be part of this dataset. HEROIC's free breach scanner covers more than 400 billion exposed records and will tell you immediately whether your email appears in this breach or any other known dataset. Visit HEROIC.com to run a free check and take action before your credentials are used against you.