The Eccountant Database Breach Exposed 60,375 User Records

HEROIC analysts identified a database breach at Eccountant, a cloud-based Enterprise Resource Planning platform operating out of Pakistan. The breach was recorded on March 23, 2025, and affected approximately 60,375 user accounts. The exposed records contained a wide range of personally identifiable information, making this more than a routine credential leak and a genuine risk to the people behind each account.

Why This Database Breach Is Dangerous

Unlike breaches that expose only email and password pairs, this one handed attackers a detailed profile on each affected user. With full names, birthdates, gender, phone numbers, and email addresses all in one dataset, bad actors can build convincingly personalized phishing messages. They can also attempt to bypass identity verification questions at banks or other services that rely on biographical data. Because the platform serves business users, some of those phone numbers and email addresses likely link to corporate accounts, widening the blast radius far beyond the individual.

What Was Exposed in the Eccountant Breach

• Email Address
• Phone Number
• Birthday
• Gender
• First Name
• Last Name

Why This Matters for Your Online Safety

Even without passwords in this dataset, the stolen information creates serious downstream risks. Attackers routinely combine PII from multiple breaches to build richer profiles. Your birthday and full name from Eccountant combined with a password from an older breach elsewhere can be enough to take over an account through account recovery flows. The risks include targeted phising emails, SIM-swapping attacks against your phone number, identity theft, and social engineering calls designed to sound credible because the caller already knows your real details.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to the back-end data store of an application or service. This can happen through unpatched software vulnerabilities, misconfigured cloud storage buckets, weak administrative credentials, or SQL injection attacks that trick the database into returning data it should not. Once inside, the attacker copies records, often in bulk, and the stolen data is then traded or sold on dark web forums and private channels. The victim organization frequently does not detect the intrusion for days or weeks, giving attackers ample time to monetize the data before any warning reaches affected users.

Check If You Are Affected by the Eccountant Breach

HEROIC's free breach scanner searches across more than 400 billion compromised records to tell you exactly where your personal information has appeared. If you had an account with Eccountant or used the same email address on other services, it is worth running a check now. Early awareness gives you time to update contact details, alert your bank, and strengthen recovery options before someone else acts on the stolen data.