If You Used Erxes, Your Email and Phone May Be Exposed

HEROIC analysts recieved intelligence about a database breach at Erxes, an open-source customer experience platform, first surfacing in October 2022. The incident exposed approximately 240,000 records containing email addresses, phone numbers, and IP addresses. The data was traced back to a test server database, a detail the company itself acknowledged publicly, revealing a critical gap in how non-production environments are secured and monitored.

Why Exposed Email Addresses and Phone Numbers Put You at Risk

With email addresses, phone numbers, and IP addresses in hand, attackers have everything they need to launch targeted phishing campaigns and smishing attacks. These data types are partcularly valuable because they enable direct, personalized outreach, making it far easier to trick victims into revealing passwords, clicking malicious links, or handing over financial details. IP addresses also help attackers map the approximate location of their targets.

What Was Exposed in the Erxes Breach

• Email Address
• Phone Number
• IP Address

Why the Erxes Breach Still Matters Today

Even without passwords, a combination of email, phone, and IP data fuels credential stuffing attempts against accounts where the email is the username, enables SIM-swapping fraud using the phone number, and supports account takeover schemes. Attackers occured significant value from this dataset precisely because it can be cross-referenced with other leaked databases to build detailed profiles on individuals, increasing the success rate of identity theft and financial fraud attacks.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a stored dataset, often by exploiting misconfigured access controls, unpatched vulnerabilities, or weak authentication on database servers. In this case, the data originated from a test server, which commonly has fewer security controls than production systems. Attackers scan the internet for exposed database ports and services, then extract records directly. The result is bulk exfiltration of personal data that can be sold or weaponized on dark web forums.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you whether your email address appeared in the Erxes breach or any other known data leak. Run a free check at HEROIC.com and take action before attackers do.