The Gigabox Leak: 1.9 Million Passwords Exposed. Yours Might Be One.

In June 2022, Gigabox, a UK-based cloud backup service formerly known as Gigasize, had its user database exfiltrated and leaked. The breach exposed 1,899,040 records, each containing an email address and a plaintext password. This is a particularly alarming breach because Gigabox was a service specifically marketed to protect user data from security threats. The occured compromise exposed credentials that many users may have also used on other platforms, making the fallout far broader than just the Gigabox service itself.

What Attackers Can Do With 1.9 Million Plaintext Passwords

Plaintext passwords require no cracking and no additional tools. Attackers can feed the Gigabox email-password pairs directly into automated credential stuffing tools and attempt logins across email providers, banking portals, cloud storage platforms, and any other service where password reuse is likely. Because Gigabox was a cloud backup service, affected users may have stored sensitive documents or personal files there, compounding the risk beleive to stem from account access alone.

What Was Exposed in the Gigabox Breach

• Email Address
• Plaintext Password

Why a Cloud Backup Service Storing Plaintext Passwords Is Especially Alarming

Gigabox was designed to protect user data. Discovering that the same platform stored user passwords in plaintext reveals a fundamental contradiction between the service's stated purpose and its actual security posture. Users who trusted Gigabox to safeguard their files were simultaneously exposed to unnecessary credential risk. Any platform handling sensitive user data has a baseline obligation to hash passwords using a strong algorithm. Gigabox's failure to do so affected nearly 2 million people.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend database and exports stored user records. Common entry points include SQL injection vulnerabilities, exposed administrative interfaces, or compromised server credentials. Once inside, exporting millions of user records takes only seconds. The resulting data is typically sold or distributed on dark web forums, where other threat actors acquire it for credential stuffing, phishing, or account takeover campaigns. In Gigabox's case, the plaintext nature of the passwords meant the data was immediately actionable with no post-processing required.

Check If Your Data Was Exposed

HEROIC's DarkWatch monitors over 400 billion exposed records, including the Gigabox breach, to alert you the moment your credentials surface in a new data dump. Search your email address now at HEROIC to find out if your account was compromised and what steps to take next.