The eLawyer Data Quietly Appeared on the Dark Web With 9,321 Plaintext Passwords

HEROIC analysts recieved a dataset in August 2022 tied to eLawyer, a boutique executive recruitment firm based in Kuala Lumpur, Malaysia. The breach affected 9,321 user accounts and exposed email addresses alongside plaintext passwords. The use of plaintext password storage means no cracking is required: anyone who obtains the data has immediate, ready-to-use credentials that can be tested across dozens of other services in minutes.

Why Plaintext Passwords Are the Worst-Case Scenario for Affected Users

When passwords are stored in plaintext, attackers do not need to crack anything. Every affected eLawyer user should consider their password fully compromised and immediately change it on any other service where it was reused. Legal recruitment platforms attract professionals who seperate their work and personal accounts less carefully than they should, making these credentials partcularly attractive for corporate email compromise and LinkedIn account takeovers.

What Was Exposed in the eLawyer Breach

• Email Address
• Plaintext Password

Why 9,321 Legal Sector Records Represent Concentrated Risk

The eLawyer platform serves legal professionals and recruiters. Credentials from this audience are valuable not only for account takeover but also for social engineering attacks against law firms and their corporate clients. A compromised legal recruiter account gives an attacker access to sensitive candidate data, client relationships, and potentially privileged communications. Credential stuffing attacks using these email and password pairs can cascade into identity theft, financial fraud, and unauthorized access to connected enterprise systems.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a web application's backend data store, often through SQL injection, an exposed admin panel, or a misconfigured cloud storage bucket. Once the attacker retrieves the user table, every record in that table including stored passwords is compromised. When passwords are stored in plaintext rather than hashed and salted, the data requires no additional processing before it can be used in attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records across thousands of known breaches, including the eLawyer incident. Visit HEROIC.com to run a free scan and find out whether your credentials are currently in circulation on the dark web.