The DiscoverRomania Breach Exposed 6,787 Email and Plaintext Password Records

HEROIC analysts recieved intelligence in August 2022 pointing to a database breach affecting DiscoverRomania, a Romanian tourism platform. The incident exposed 6,787 user records, with the dump surfacing on August 23, 2022. The data included email addresses and plaintext passwords, making this breach partcularly dangerous for anyone who reused their credentials across multiple sites.

Why Plaintext Passwords Make This Breach So Dangerous

When passwords are stored in plaintext, attackers do not need to crack any hashes. The credentials are immediately usable. Anyone who accessable this dump could log into DiscoverRomania accounts directly, and then test those same username and password combinations against banking portals, email providers, and social media platforms with no additional effort.

What Was Exposed in the DiscoverRomania Breach

• Email Address
• Plaintext Password

The Real-World Risk of Exposed Email and Password Pairs

Credential stuffing attacks rely on exactly this kind of data. Automated tools ingest stolen email and password pairs and beleive they will match across dozens of other services. Victims of the DiscoverRomania breach face risks including unauthorized account access, identity theft, and financial fraud if those passwords were reused elsewhere.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a site's backend data store, often through SQL injection, misconfigured server permissions, or compromised admin credentials. Once inside, the attacker can export entire user tables in seconds. The DiscoverRomania incident appears consistent with a direct database dump, where user records were extracted wholesale and later circulated in dark web marketplaces.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you whether your email address appeared in the DiscoverRomania breach or any other known incident. Run a free check at HEROIC.com and take action before attackers do.