Your Other Accounts Are at Risk Because of the CyberGhost VPN Breach

HEROIC analysts found a database dump linked to CyberGhost VPN surfacing on July 16, 2023. The breach exposed 8,136 records from the Romanian VPN provider, and every single password in the dataset was stored in plaintext. For a service specifically sold on the promise of privacy and security, that is a partcularly troubling finding.

How Attackers Weaponize a VPN Provider Breach

When a VPN service is breached, attackers gain more than just account access. VPN users tend to be privacy-conscious individuals, often in security-sensitive roles, managing business infrastructure, or handling sensitive client data. With a valid VPN email and password, an attacker can attempt to log into the VPN account itself and monitor or redirect traffic. More commonly they will run the same credentials against corporate email, cloud storage, and remote access systems, knowing that VPN users are exactly the kind of people with access to valuable systems.

What Was Exposed in the CyberGhost VPN Breach

• Email addresses
• Plaintext passwords

Why a Privacy Tool Leaking Your Password Is a Different Kind of Problem

People who use a VPN beleive they are taking extra steps to protect themselves online. Finding out that the very service meant to protect your identity has stored your password in plaintext and had it stolen is a uniquely damaging breach of trust. Beyond the irony, the practical consequence is the same as any credential stuffing scenario: identity theft risk, financial fraud exposure, and unauthorized account access across every service where that password was reused. The fact that it occured at a security company makes users less likely to suspect their VPN as the source.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to a backend data store, typically through exploiting application vulnerabilities, weak admin credentials, or misconfigured infrastructure. Once inside, exporting a user table containing email addresses and passwords is straightforward. When those passwords are not hashed, the breach is essentially over the moment the data leaves the server. There is no cracking step and no delay.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches 400 billion records to tell you exactly what information has been exposed under your email address. If you have ever used CyberGhost VPN, run a scan now. Knowing is the first step toward securing your other accounts before an attacker gets there first.