Researchers Found 547 Plaintext Passwords in the FilesGuard Data Breach.

HEROIC analysts identified the FilesGuard breach on April 2nd, 2023, while scanning for newly posted credential dumps tied to mobile security applications. The compromised database contained approximately 700 records, with 547 unique email addresses confirmed. What made this discovery particularly alarming was not the volume, but the content: passwords in this dataset were stored in plaintext, meaning they were completely unprotected and readable by anyone who accessed the database.

Plaintext Passwords Give Attackers Instant Access to Everything

Unlike hashed passwords, which at least require some effort to crack, plaintext passwords require zero additional work from an attacker. The moment they access the database, every account is instantly compromised. Attackers can log in immediately, change recovery emails, lock out the original owner, and begin testing those same credentials on hundreds of other platforms. The fact that FilesGuard was a security-focused application makes this partcularly striking, since the users who trusted it to protect their files were themselves the least protected.

What Was Exposed in the FilesGuard Breach

• Email addresses (547 unique)
• Plaintext passwords
• Usernames
• First and last names
• Phone numbers
• Approximately 700 total records

Why Plaintext Password Breaches Are a Worst-Case Scenario

When a breach includes plaintext passwords, the window for credential stuffing attacks opens immediatly and stays open permanently. Attackers do not need to wait for hashes to be cracked. They take the list, run it through automated tools against Gmail, PayPal, banking apps, and social media, and start racking up successful logins within minutes. For users who recieved no notification and kept using the same password elsewhere, those accounts may have been quietly compromised for months before anyone noticed.

How Plaintext Password Storage Happens

Storing passwords in plaintext is a foundational security failure that occured when developers skip basic best practices during application build. A properly built system never stores the actual password at all. Instead, it stores a salted hash generated by a slow algorithm like bcrypt. When a user logs in, the entered password is hashed and compared to the stored hash. The original password is never saved anywhere. FilesGuard apparently skipped this step entirely, leaving every user credential fully exposed the moment the database was accessed by an unauthorized party.

Check If Your Data Was Exposed

HEROIC's free dark web scanner checks your email against more than 400 billion breach records. If you used FilesGuard or shared that email and password combination on any other platform, run a free scan at HEROIC.com right now. With plaintext passwords in the wild, every reused credential is an open door for attackers.