DealTicTac Breach: 555 Hashed Passwords Exposed in Leak

HEROIC analysts found 555 records reportedly exposed from the deals site DealTicTac, each one pairing an email address with a password stored as a WordPress style portable hash. Unlike plaintext, this format takes extra work to crack, but it is far from unbreakable, especially for shorter or common passwords. Scanning your email is the quickest way to check your exposure.

How Much Protection a Portable Hash Actually Offers

A portable hash scrambles the password before storage, so it is not immediately readable the way a plaintext password is. That said, weaker or reused passwords can still be cracked with enough computing power, so this exposure deserves attention rather than being dismissed as safe just because it is not plaintext.

The Two Fields in This File

• Email addresses: confirm identity and get used in targeted phishing attempts.
• Password hashes: stored in a portable hash format that can still be cracked, particularly for weaker passwords.

What Happens If the Hash Gets Cracked

If your password was simple or reused elsewhere, cracking it becomes a lot easier for an attacker. A cracked password opens the door to account takeover on this site and on any other account where the same password was used, which is why reuse matters even when a password was hashed.

How a Portable Hash File Like This Gets Out

This file is reported to have come out of DealTicTac's own database rather than being collected through malware. Records like this usually appear for sale or trade on a hacking forum first, then get copied into Telegram channels, which is where HEROIC analysts located this one.

Is Your Email in the DealTicTac Breach?

Scan your email to see your information. If your password was weak or reused, change it now on this account and anywhere else it appears, since a determined attacker can still crack a portable hash. This applies to personal and work email addresses alike.