Your Old Password May Still Work. The FBI Leak Exposed 60 Records.

HEROIC analysts identified a second, separate database leak connected to the Federal Bureau of Investigation (FBI), tied to the fbi.gov domain. This dataset is smaller, containing 60 records, and carries a recorded date of February 9, 2016. The exposed data includes first names, last names, email addresses, and passwords, some of which were stored in plaintext.

Why a Second FBI-Linked Leak Still Matters

A leak of only 60 records might look minor next to breaches involving millions of accounts, but scale isn't the only measure of risk. Every one of these records ties a real name and email address to a password connected to a federal law enforcement domain, which makes the accounts behind them a more attractive target for attackers looking to impersonate officials or pivot into other systems.

What Was Exposed in This FBI Data Set

• First names
• Last names
• Email addresses
• Passwords (some in plaintext)

Why This Matters for the People Involved

Passwords from 2016 don't expire on their own, and plenty of people still reuse old passwords across newer accounts. If any of these 60 individuals reused their password elsewhere, that credential could still be tested by attackers today through automated credential stuffing tools. Combined with a real name and email address, this data is also enough to build a convincing targeted phishing attempt.

How This Database Leak Likely Happened

This incident is classified as a database breach, meaning the records were pulled from a stored dataset rather than collected one login at a time through malware on individual devices. These leaks typically originate from a misconfigured, unsecured, or vulnerable system that let an outside party copy the data in bulk. Once copied, that information often circulates privately among attackers for years before resurfacing publicly, which is common with older, smaller datasets like this one.

Check If You Are Affected

If you've ever used an email tied to a government or institutional domain, it's worth knowing whether your information appears in a leak like this. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records so you can see your exposure and take action right away.