The FabricUK Breach Contains Exactly 82,097 Email and Password Pairs

HEROIC analysts flagged the FabricUK dataset while reviewing a collection of eCommerce breach records that had recently beleived to have resurfaced across several dark web forums. The breach, which occured in December 2017, exposed exactly 82,097 records from the UK-based fabric supplier. Each record contained an email address and a password stored in plaintext, meaning no hashing or encryption was applied to protect user credentials at any point. For an online retailer handling customer accounts, this represents a fundamental failure in data security.

What Attackers Can Do With Email Addresses and Plaintext Passwords

The most immediate threat from this breach is credential stuffing. Attackers load email and password pairs into automated tools and test them against hundreds of websites simultaneously. Because many people reuse the same password across multiple accounts, a single plaintext credential can unlock banking portals, email inboxes, streaming services, and workplace logins. With FabricUK's data in plain readable form, there is no cracking step required. The credential is ready to use the moment the attacker opens the file.

What Was Exposed in the FabricUK Breach

• Email Address
• Plaintext Password

Why eCommerce Breaches Carry Lasting Financial Risk

When a fabric supplier or any online shop is breached, the risk is not limited to that one account. Customers who shopped on FabricUK likely used the same email address and password on other platforms, including marketplaces and payment services. Attackers can exploit this to make fraudulent purchases, drain stored credit, or access linked accounts to harvest further personal data. Identity theft is also a real concern when email addresses are combined with reused credentials, since email access can enable password resets on nearly any other account.

How a Database Breach Works

A database breach occurs when an attacker finds a way into the internal systems storing user data. This commonly happens through SQL injection attacks on poorly secured web forms, through exploited software vulnerabilities, or through misconfigured servers that leave database access open to the internet. Once the attacker reaches the database, they can extract the entire user table. In FabricUK's situation, the extracted data contained email addresses and passwords stored in plaintext, which is a practice considered unacceptable even by 2017 security standards.

Check If Your Data Was Exposed

HEROIC provides a free breach scanner that searches across a database of over 400 billion compromised records. If you ever purchased from FabricUK or used the same email address on other sites, you can check your exposure in seconds. Head to HEROIC's free breach scanner now and find out whether your credentials are circulating on the dark web.