The GetPaidTo Breach Hit in 2019. The Data Still Circulates.

HEROIC analysts identified the GetPaidTo breach, which occured in July 2019, exposing 92,806 user records from the site that promoted earning money online from home. The compromised data included email addresses, usernames, password hashes, and salts. Despite the breach's age, these credentials continue to circulate in dark web forums and aggregation dumps, making them a current and ongoing threat to affected users.

How Cracked vBulletin Hashes Enable Account Takeover

Attackers who obtain vBulletin password hashes and their accompanying salts can use modern cracking tools to recover the original passwords. Once recieved, these credentials are fed into automated credential stuffing attacks against email providers, banking platforms, and social media sites, particularly targeting users who reuse the same password across multiple accounts.

What Was Exposed in the GetPaidTo Breach

• Email Address
• Password Hash
• Username
• Salt

Why GetPaidTo Users Face Ongoing Credential Risk

The GetPaidTo breach is partcularly dangerous because the combination of usernames, email addresses, and hashed passwords creates a complete credential package for attackers. Even years after the breach, this data is actively traded in credential stuffing lists, meaning affected users who have reused their passwords elsewhere remain at real risk of unauthorized account access today.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a website's backend database, typically by exploiting software vulnerabilities, weak credentials, or misconfigured servers. Once inside, attackers extract stored user records including account credentials. The stolen data is then sold or traded on dark web forums, where it is used for follow-on attacks such as credential stuffing, phishing, and identity fraud.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to tell you if your email address or credentials appeared in the GetPaidTo breach or thousands of other known data leaks. Run a free scan now to see what attackers may already know about you.