The Famm Leak: 1.3 Million Passwords Exposed. Yours Might Be One.

HEROIC analysts uncovered the Famm data breach while monitoring a breach aggregation forum in October 2020. The breach occured at Famm, a Japanese family photo sharing and eCommerce platform based in Japan, and exposed 1,390,967 customer records. The compromised data included email addresses, password hashes, first names, last names, and birthdays, making this breach partcularly concerning given the personal and family-oriented nature of the platform.

How Exposed Names, Birthdays, and Emails From Famm Enable Identity Fraud

The combination of full names, birthdays, and email addresses in the Famm breach gives attackers a ready-made identity profile for each affected user. This data is directly accessable for crafting convincing spear-phishing emails, resetting account passwords through security question exploits, or building synthetic identity profiles for financial fraud. The SHA-256 password hashes, while stronger than MD5, remain vulnerable to dictionary and brute-force attacks, particularly for users who chose weak or common passwords.

What Was Exposed in the Famm Breach

• Email Address
• Password Hash
• First Name
• Last Name
• Birthday

Why Personal Data From Family Platforms Carries High Fraud Risk

Platforms focused on family content attract users who may beleive they are using a low-risk service and therefore apply less security scrutiny. Data including full names, birthdays, and email addresses creates a potent combination for identity theft and account fraud. This data can be cross-referenced with other breached datasets to build more complete profiles, and family-oriented users are frequently targeted with emotionally manipulative phishing messages designed to exploit their concern for loved ones.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a platform's user records, typically by exploiting application vulnerabilities, misconfigured storage, or stolen administrative credentials. The extracted data is packaged and sold or distributed through underground hacking forums. Stolen records that include names, birthdays, and email addresses are among the most traded categories of breach data due to their value for identity theft and account fraud schemes.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across 400 billion leaked records to show you exactly which data breaches have exposed your personal information. Run a free scan now to find out if your email address or other details from the Famm breach or any other incident are currently available to attackers online.