The Cross Expert Breach: 7,797 Russian Fitness Accounts Exposed

In November 2024, Cross Expert, a Russian fitness website, suffered a database breach that exposed the account credentials of approximately 11,600 users. The dumped data appeared on an underground forum on November 23, 2024, and included email addresses, usernames, and PHPass-hashed passwords. While hashed passwords are a step above plaintext, PHPass hashing offers limited protection against modern cracking tools -- meaning many of these passwords may already be in plaintext in the hands of attackers.

Why This Is Dangerous

Password hashes are not permanently safe. PHPass, the hashing scheme used by Cross Expert, is an older algorithm frequently associated with WordPress and early PHP applications. Modern GPU-based cracking rigs can test billions of PHPass hashes per second. Weak or common passwords in this dump will be cracked quickly, giving attackers working email-password pairs they can test across banking, social media, and other services.

What Was Exposed

• Email addresses -- 7,797 unique accounts tied to real identities
• Usernames -- platform-specific but often reused elsewhere
• PHPass hashed passwords -- crackable with modern hardware, especially for common passwords

Why This Matters

Even hashed credentials create immediate risk once leaked:

• Credential stuffing: Cracked passwords are tested automatically across thousands of websites and apps.
• Account takeover: Users who reuse their Cross Expert password on email, banking, or shopping accounts face direct compromise.
• Identity theft: Email plus username creates a verified identity pair attackers use to build profiles or attempt account recovery exploits.
• Phishing follow-up: Exposed emails feed into targeted phishing campaigns, often impersonating fitness brands or health platforms.

How Database Breaches Work

A database breach typically involves exploiting a vulnerability in a web application or its underlying infrastructure -- SQL injection, exposed admin panels, or unpatched software. Once inside, the attacker exports the user table, which in this case contained hashed credentials. The dump is then sold or posted publicly on hacking forums, where credential cracking services process the hashes and circulate the results.

Check If You Are Affected

If you have ever registered on Cross Expert or used the same email and password combination on any fitness or health platform, your credentials may be exposed. HEROIC's database spans 400 billion+ breached records. Search your email now to find out if your account appears in this breach or others.

Search the HEROIC Database -- Free Scan