FSBO Data Leak Exposed 23,803 Plaintext Passwords Since 2018

HEROIC analysts traced a data breach back to FSBO, a U.S.-based website aimed at homeowners selling property without a real estate agent. The data surfaced on a well-known hacking forum on August 24, 2018, and includes 23,803 records made up of email addresses and plaintext passwords. This breach sat on forums for years before this analysis, meaning the exposure window for affected users has been open far longer than most people realize.

Why This Is Dangerous

Storing passwords in plaintext means there was no encryption protecting user accounts in the first place. Anyone who obtained this dump had immediate, working logins rather than scrambled data that needed to be cracked. Years after the original leak, these same email and password combinations can still open accounts for people who never changed them.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

A password leaked in 2018 does not expire on its own. If anyone from this list reused their FSBO password on their email, banking, or shopping accounts and never changed it, they remain exposed today to credential stuffing, account takeover, identity theft, and financial fraud, years after the original incident.

How Database and Combolist Breaches Age Into Bigger Threats

This incident is classified as a database and combolist breach, meaning attackers pulled a full set of stored login records directly from FSBO's systems. Once uploaded to a hacking forum, that data doesn't disappear. It gets copied, recirculated, and folded into larger combolists used for automated attacks for years afterward, which is exactly why old breaches like this one still matter.

Check If You Are Affected

If you ever had an FSBO account, it is worth checking whether your email and password are still floating around from this leak. HEROIC's free breach scanner checks your details against a database of more than 400 billion leaked records, so you can confirm your exposure and update any old passwords still in use.