FrancoBordo’s eCommerce Breach Leaked 7,137 Spanish Passwords

HEROIC analysts have added the FrancoBordo data breach to our records. FrancoBordo, a Spanish ecommerce platform at francobordo.com, was breached on August 21, 2018, exposing 7,137 unique records. The compromised data includes email addresses and plaintext passwords, which were shared on a popular hacking forum.

Why This Is Dangerous

Because these passwords were stored and leaked in plaintext, there is no encryption for an attacker to break through. Each of the 7,137 records pairs a shopper's email address directly with their exact password, giving anyone who obtains this file everything needed to attempt a login on FrancoBordo or anywhere else the same password was reused.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Ecommerce platforms like FrancoBordo are a favorite target for this kind of breach because shoppers often reuse the same password across multiple retail sites, email accounts, and even banking logins. A leak like this one feeds directly into credential stuffing, where attackers automatically test stolen email and password combinations across other services, leading to account takeover, identity theft, or financial fraud far beyond the original store.

How This Combolist Was Created

FrancoBordo's breach is classified as a database and combolist incident, meaning attackers accessed the platform's own customer database and later compiled the stolen data into a combolist, a simple file pairing each email address with its matching password. Combolists like this one are traded and reposted on hacking forums for years after the original breach, remaining effective against anyone who never changed the exposed password.

Check If You Are Affected

If you ever shopped at FrancoBordo, your email and password may still be circulating on hacking forums today. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including the FrancoBordo breach, so you can find out quickly whether your information was exposed.