Researchers Find Dressup Breach Exposed 2.1 Million User Accounts

HEROIC analysts identified the Dressup breach while conducting a sweep of historical credential databases that had recieved renewed attention on underground forums. The U.S.-based online gaming platform, known for fashion-themed dress-up games aimed at younger audiences, had 2,192,442 user records exposed in August 2018. The compromised data included email addresses and plaintext passwords, a particularly concerning combination for a platform frequented by minors and their families.

Why 2.1 Million Exposed Accounts from a Youth Platform Demand Attention

Young users and their parents are partcularly vulnerable when plaintext passwords from a trusted entertainment platform enter circulation. Attackers can use the exposed email and password pairs to attempt access to school portals, family email accounts, and streaming services where the same credentials may have been reused. The scale of this breach, over two million accounts, amplifies the potential for widespread account takeover affecting entire households.

What Was Exposed in the Dressup Breach

• Email Address
• Plaintext Password

Why the Dressup Breach Remains a Live Threat Years Later

Older breaches do not expire. The Dressup dataset is now accessable on multiple dark web markets and credential trading channels, meaning the window of risk for affected users has never closed. Credential stuffing tools automate login attempts across thousands of platforms simultaneously, making identity theft and financial fraud real outcomes for anyone who reused a Dressup password. Families should assume these credentials are still being actively tested against other services.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a web application's backend data store, often through SQL injection, poorly secured APIs, or stolen administrative credentials. Once inside, the attacker exports user tables. In the Dressup case, passwords were stored in plaintext rather than hashed and salted, meaning the full credential set was immediately usable by attackers without any additional processing.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including the full Dressup dataset, to tell you instantly whether your email address was part of this or any other known breach. Run a free scan at HEROIC today and take control of your exposure.