One Facebook Leak: 125 Email Addresses, No Passwords Exposed

HEROIC analysts identified a data breach tied to Facebook, dated September 27, 2015. The breach exposed 125 records, each consisting of an email address. No passwords were included in this exposure.

Why an Exposed Facebook Email List Still Matters

An email address tied to a Facebook account confirms something specific: that the person behind it has an active social media presence, complete with a network of friends, family, and connections. That context is valuable to scammers, who can use it to craft convincing phishing emails pretending to be Facebook security alerts, friend requests, or account verification notices. Even without a password attached, a confirmed and active email address tied to a known platform is a useful starting point for social engineering.

What Was Exposed

• Email addresses of Facebook users
• No passwords were part of this exposure

Why This Matters

An email address rarely stays isolated for long. Criminals routinely combine lists like this one with data from other breaches, matching an email to a password, phone number, or other detail leaked elsewhere. Once combined, that data can be used for credential stuffing, targeted phishing, or broader identity theft. If you have ever reused a password with this email address on another account, that risk exists independent of what this specific record contains.

How This Database Breach Happened

This incident is classified as a database breach, meaning the records were extracted directly from stored user data rather than collected from individual devices. Breaches like this typically trace back to unpatched software, misconfigured servers, or unauthorized access to backend systems. Once copied, data like this can circulate quietly for years before surfacing again, which is why a 2015 exposure can still be relevant today.

Check If You Are Affected

If you have a Facebook account, or have ever used this email address to sign up for one, it is worth checking whether your information was exposed. HEROIC's free breach scanner searches more than 400 billion leaked records to give you an instant answer, so you can stay ahead of phishing attempts built around this and other breaches.