Inside the D-Gem Breach: How 22,026 Plaintext Passwords Leaked

HEROIC analysts found roughly 22,026 records from D-Gem, a now-defunct German ecommerce jewelry retailer, circulating on a public hacking forum. The breach is dated August 21, 2018, and the exposed data includes email addresses paired with passwords stored in plaintext, meaning the passwords were never hashed or encrypted in the first place.

Why This Is Dangerous

Plaintext password storage is one of the most serious mistakes a website can make. There is no cracking or brute-forcing required. Anyone who gets access to the database, or to a leaked copy of it, can read every password exactly as the customer typed it. That means each of the 22,026 email and password pairs from this breach is immediately usable by an attacker, with no extra effort needed to unlock it.

What Was Exposed in the D-Gem Breach

• Email addresses
• Plaintext passwords

Why This Matters

Because these passwords were never protected in the first place, this data is especially valuable for credential stuffing attacks, where automated tools try stolen email and password pairs against banking sites, email providers, and social media platforms. Anyone who reused their D-Gem password anywhere else is at meaningful risk of account takeover, identity theft, or financial fraud, even though the original jewelry store no longer exists.

Inside the D-Gem Database Breach and Combolist Exposure

This incident is classified as a database breach that was later folded into a combolist. A database breach means an attacker got direct access to the site's stored user table, likely through a software vulnerability or an exposed server, and copied it wholesale. Because D-Gem stored passwords in plaintext rather than as hashed values, the stolen data required no further work to be useful. From there, it was combined with records from other breaches into a combolist, a large file of ready-to-use email and password pairs that attackers feed into automated login tools to test against hundreds of other sites at once. Plaintext storage is exactly the kind of failure that turns an old, small breach into a long-lasting threat.

Check If You Are Affected

If you ever had an account with D-Gem, or if you tend to reuse the same password across different sites, it is worth checking whether your information is part of this exposure. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this one, so you can see what has been exposed and secure your accounts before someone else uses this data against you.