CrumplePop Data Breach: 26,460 US Customers Exposed — Names, Emails, and Order History

CrumplePop Audio Software Leak Exposes 26,460 US Customer Records

CrumplePop, a US-based audio software company known for its noise removal and cleanup tools, suffered a database breach in August 2025 that exposed the personal records of 26,460 customers. Unlike most database breaches, this incident did not include password hashes -- but that doesn't mean affected users are safe. The exposed data includes full names, email addresses, and customer order history, creating a detailed profile of each individual that is highly valuable for targeted phishing, social engineering, and identity fraud. For a B2B and prosumer software audiance, the risk is compounded by the profesional context of the exposed data.

CrumplePop (August 2025): Breach Summary

• Records Exposed: 26,460
• Data Types: Email addresses, first names, last names, order details
• Breach Type: Database breach -- customer data exfiltrated from a compromised server database
• Password Type: No Passwords -- authentication credentials were not included in the exposed data
• Country: United States
• Date Leaked: 25-Aug-2025

No Passwords Doesn't Mean No Risk

When a breach contains no password hashes, it's tempting to dismiss the incident as low-severity. This is a dangerouse misreading of how modern identity fraud operates. The CrumplePop breach exposed full names, verified email addresses, and purchase histories -- a combination that gives attackers everything they need to craft convincing spear-phishing campaigns. An attacker who knows that a specific customer purchased CrumplePop's audio cleanup plugin on a specific date can send a targeted email impersonating CrumplePop support, referencing the exact product and purchase date, and requesting account verification or payment update. The specificity of this kind of lure dramatically increases click-through rates compared to generic phishing templates.

Order History as Social Engineering Fuel

Purchase records are among the most underappreciated data types in breach analysis. Knowing that a specific individual bought a specific software product tells an attacker far more than a password hash ever could: it reveals professional context, purchasing behavior, likely technical sophistication, and organizational affiliation. CrumplePop's user base -- audio engineers, podcast producers, video editors, and broadcast professionals -- represents a cohort with access to production systems, media infrastructure, and in many cases enterprise or broadcast networks. A targeted attack on a media professional that succeeds in harvesting their credentials through a CrumplePop-themed phish could cascade into far more consequential access than the original breach data suggests.

The August 2025 Timing and Breach Freshness

The CrumplePop breach was disclosed in August 2025, making it among the more recent incidents currently appearing in breach databases. Fresh PII records are particularly valuable because the contact information is current -- email addresses haven't been abandoned, names haven't changed, and the purchase context is recent enough to be plausible in phishing lures. Affected customers who haven't received direct notifcation from CrumplePop should assume their information is in active circulation and treat any email claiming to be from the company with heightened scrutiny, particularly if it requests login, payment, or identity verification.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to check whether your email address appears in known data breaches, including recent software company leaks like CrumplePop. Even without passwords in the breach, your name and email exposure warrants immediate attention. Visit HEROIC's breach scanner to check your exposure for free.