DIP Data Breach Pairs Emails With Passwords Across 2,228 Records

HEROIC analysts reported a data breach tied to DIP (dip.fr) that exposed 2,228 records, and the riskiest detail is that some entries pair an email address with a plaintext password while others pair an email address with a password hash instead. The plaintext pairs are immediately usable with no extra work, while the hashed ones add a layer that can still be broken over time. The only way to know if you were affected is to scan your email.

Two Kinds of Risk in One Leak

Mixing plaintext and hashed passwords in a single exposure means different people in the same leak face different timelines of risk. Anyone with a plaintext entry is exposed the moment the data circulates, while those with a hashed entry have a bit more breathing room, but only until that specific hash is cracked. Neither situation is safe to ignore.

The Details Found in This Leak

• Email Address
• Plaintext Password
• Password Hash

What This Could Mean for Your Other Accounts

If your record included a plaintext password, someone can attempt it on other sites right away, and if it was hashed, the same risk arrives later once that hash is broken. Either way, your email becomes part of a dataset that can be used to send phishing messages referencing DIP directly, making a fake request for login or payment details appear more legitimate.

How a Mixed Format Leak Like This Occurs

This is a database style breach, meaning the records came directly from the service's own systems rather than from malware on personal devices. Companies sometimes update how they store passwords over time, so older accounts may still carry an outdated format like plaintext while newer ones use a hash, and both get taken together when the database itself is accessed without permission.

Could Your Email Be in Either Group?

Take a moment to scan your email and see whether your address appears in this exposure. If it does, change that password everywhere you have reused it, regardless of whether it was stored as plaintext or a hash, and set a unique password for each account from here on. Check this for your personal email as well as any work email you may use.