The EuroMilhões Leak Exposed 16,520 Email and Password Pairs

HEROIC analysts found a 2015 breach of EuroMilhões, the Portuguese lottery website, that exposed 16,520 accounts. The leaked records include email addresses, usernames, and passwords protected with vBulletin's hashing scheme, all pulled directly from the site's user database.

Why the EuroMilhões Leak Is Dangerous

Although these passwords were hashed rather than stored in plaintext, vBulletin's hashing method is old and well understood by password-cracking tools. Given the leak is a decade old, most of these hashes have likely already been cracked back into their original passwords, meaning the practical risk is close to what you would see with plaintext.

What Was Exposed in the EuroMilhões Breach

• Email addresses
• Usernames
• Password hashes (vBulletin format)

Why This Matters

Even a small breach like this one matters because people rarely use a unique password for a lottery website. If your EuroMilhões password was reused on your email or banking accounts, cracked credentials from this leak could unlock them through credential stuffing. Usernames and emails on their own also make useful targets for phishing.

How This Database Breach Happened

This is classified as a database breach, meaning attackers extracted user records directly from EuroMilhões' backend, likely a vBulletin forum installation, rather than harvesting individual logins. Once a database dump like this leaves the original site, it tends to keep circulating among data traders for years, exactly what has happened here.

Check If You Are Affected

If you ever registered on EuroMilhões, it is worth confirming whether your details were part of this leak. HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including this breach, so you can find out in seconds.