How the Daxy Database Breach Led to 1,135 Plaintext Passwords Being Stolen

HEROIC analysts discovered the Daxy database on a dark web forum in May 2021. The Bulgarian business intelligence platform had stored passwords in plaintext, and the breach exposed 1,135 records containing email addresses, phone numbers, usernames, plaintext passwords, and IP addresses. Storing passwords without any hashing is a critical security failure, and this data was recieved by threat actors as a ready-to-use credential list.

Plaintext Passwords Mean Every Daxy Account Was Instantly Compromised

Unlike hashed passwords, plaintext passwords require no cracking. Anyone with access to this database dump could immediately log into affected accounts using the exposed credentials. Credential stuffing tools then test these email and password pairs across hundreds of other platforms automatically, making account takeover on banking, email, and social media services partcularly likely for anyone who reused their Daxy password.

What Was Exposed in the Daxy Breach

• Email Address
• Phone Number
• Plaintext Password
• Username
• IP Address

Why Five Data Types in One Breach Multiplies the Risk

The Daxy breach exposed a complete attacker toolkit: email addresses and passwords for account takeover, phone numbers for SIM-swap and smishing attacks, usernames for social engineering, and IP addresses for geolocation. This combination enables not just credential stuffing but targeted identity theft and financial fraud. The damage occured well beyond the platform itself for users who reused credentials elsewhere.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a platform's backend data store and extracts records in bulk. In cases like Daxy, poor security practices such as storing passwords in plaintext make the stolen data immediately exploitable without any additional effort. The extracted database is then distributed on dark web forums where it is purchased and used for automated credential attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches 400 billion+ compromised records, including the Daxy database. Enter your email at heroic.com to find out immediately whether your credentials were exposed in this breach or any other known data leak.