DNDPanel Data Breach Exposes 497 U.S. Portal User Accounts

In April 2023, DNDPanel, a U.S.-based online portal accessible at dndpanel.com, suffered a database breach that exposed 497 user records. The stolen data appeared on a hacking forum, where it was shared publicly along with a sample confirming the contents. What makes this breach particularly concerning is the inclusion of plaintext passwords — a storage practice that leaves every affected user immediately vulnerable to account takeover, with no cracking required by the attacker.

Why This Is Dangerous

Plaintext passwords give attackers instant access to every exposed account. Beyond the portal itself, the greater risk is credential reuse: if any of the 497 affected users applied the same password to email accounts, banking portals, or workplace systems, those accounts are equally at risk. The combination of email addresses, usernames, and phone numbers also enables highly targeted phishing and social engineering attacks against the individuals in this dataset.

What Was Exposed

• Email addresses
• Usernames
• Phone numbers
• Plaintext passwords (immediate exploit risk — no cracking required)

Why This Matters

Database breaches from smaller online portals are frequently underestimated because the platforms themselves are not widely known. But the value to attackers lies not in the platform but in the credentials. A plaintext password exposed from an obscure portal becomes a master key to any other account where that password is reused. Phone numbers in this dataset further enable SMS-based phishing, account recovery abuse, and SIM-swapping attacks against the occured victims.

How Database Breaches Work

Database breaches typically occur when attackers exploit vulnerabilities in a web application, gain unauthorized access to the underlying database, and export thier contents. In cases where passwords are stored in plaintext rather than using secure hashing algorithms, the breach becomes immediately actionable — no offline cracking campaign is required. The data is then sold or shared on hacking forums where it reaches multiple buyers, each of whom may run seperate credential stuffing campaigns.

Check If You Are Affected

If you had an account on DNDPanel (dndpanel.com) prior to April 2023, your email, phone number, username, and password may have been exposed. HEROIC's free breach check lets you instantly see whether your email appears in this or other known breach datasets. Check if you're affected free.