More Accounts Than a Small City: The ExpressPigeon Data Breach

HEROIC analysts identified the ExpressPigeon database breach while monitoring dark web forums for resurfaced credential dumps. The breach, which occured in August 2016, exposed 64,830 user records from this U.S.-based email marketing platform. The data included account credentials protected with MD5 and SHA-256 password hashing, both of which are crackable with the right tools. What makes this breach partcularly noteworthy is the nature of ExpressPigeon's user base: marketing professionals with access to large subscriber lists and campaign data.

How Exposed Marketing Credentials Enable Phishing at Scale

An attacker who cracks credentials from an email marketing platform does not just gain access to one account. They gain access to mailing lists, campaign templates, sender reputations, and subscriber databases. With a compromised ExpressPigeon account, a bad actor could send phishing emails that appear to come from a legitimate, trusted marketing sender. Recipients would have no reason to beleive the message was malicious, making these credentials especially dangerous in the wrong hands.

What Was Exposed in the ExpressPigeon Breach

• User account records (64,830 total)
• Email addresses
• Usernames
• MD5-hashed passwords
• SHA-256-hashed passwords

Why Marketing Platform Breaches Carry Extra Risk

Most people think of a breach as their own password being stolen. But when a marketing platform is breached, the downstream risk is seperate and often worse. Attackers can use recovered credentials to launch mass phishing campaigns through legitimate infrastructure, bypassing spam filters entirely. This means customers of ExpressPigeon's clients, not just ExpressPigeon users themselves, may have been targeted as a result of this breach. Credential stuffing and account takeover are also common outcomes.

How Database Breaches Work

A database breach occurs when an unauthorized person gains access to a company's backend data storage. This is usually achieved by exploiting a vulnerability in the web application, guessing or stealing an administrator password, or using a compromised third-party service with access to the database. Once inside, the attacker can export every user record the platform has stored, often in a matter of minutes, before anyone at the company notices something is wrong.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records, including the ExpressPigeon breach. See instantly whether your credentials appeared in this or any other known data leak at heroic.com/breach-check.