The E-Click Leak Quietly Exposed 46,833 Passwords Years Later

HEROIC analysts flagged a database leak from E-Click, a now-defunct Greek e-commerce platform, that first surfaced on a hacking forum around August 26, 2018. It never made headlines. The data simply sat there, quietly available, exposing 46,833 records made up of email addresses and plaintext passwords.

Why This Is Dangerous

Because E-Click stored passwords in plaintext, there was never any hashing or encryption to break through. Anyone who has this dataset can read every password directly and pair it instantly with the email address it belongs to, with no cracking or delay involved.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

A quiet leak is not a harmless one. Old, low-profile datasets like this one still circulate on hacking forums and get used for credential stuffing, where attackers try the same email and password pair on other services. If anyone among the 46,833 people in this leak still uses that E-Click password anywhere else, they remain exposed to account takeover, identity theft, or financial fraud years after the site itself went offline.

How This Database Leak Happened

This incident is classified as a database and combolist leak, meaning the data was pulled directly from E-Click's backend, likely through a website vulnerability, and compiled into a combolist, a simple list of email and password pairs built for easy reuse. Because the passwords were never hashed in the first place, this leak required no additional cracking step to become fully usable, which is part of why it has stayed quietly active for so long.

Check If You Are Affected

If you ever had an account on E-Click or reused a password across multiple sites, HEROIC's free breach scanner can check your email address against a database of more than 400 billion leaked records, including this one. Run a scan now to see if your information was exposed.