IT Services Customers Exposed: The Formmail Database Breach Leaked 232K Records

HEROIC analysts identified a database breach affecting Formmail, a French customizable web form service in the IT Services sector. The breach, which occured in April 2021, exposed 232,246 user records. The data leaked included email addresses and plaintext passwords, a partcularly alarming combination that puts affected users at serious ongoing risk.

Plaintext Passwords: Why the Formmail Breach Is Especially Dangerous

When passwords are stored in plaintext, attackers recieved them in fully usable form with zero effort. There is no cracking required. A threat actor with access to this data can immediately attempt to log into email providers, banking apps, or corporate accounts using the exact credentials stolen from Formmail users.

What Was Exposed in the Formmail Breach

• Email Address
• Plaintext Password

Why the Formmail Breach Puts Users at Long-Term Risk

Credential stuffing attacks powered by this dataset remain a threat years after the original leak. Attackers recycle breach data through automated tools to test logins across hundreds of services. Anyone who used the same email and password on Formmail and has not since changed their credentials is accessable to account takeover, identity theft, and financial fraud today.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend database, typically by exploiting unpatched vulnerabilities, weak credentials, or misconfigured servers. Once inside, the attacker can extract all stored records. In Formmail's case, because passwords were not hashed, the stolen data required no additional processing to weaponize.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you whether your email address appeared in the Formmail breach or any other known data leak. Run a free check now at HEROIC to find out if your credentials are circulating on the dark web.