Our Analysts Found the Grapevine Dump Circulating With 325,045 Crackable Passwords

Our analysts found a substantial data dump tied to Grapevine, a US-based food delivery aggregation app, circulating across underground channels on June 1st, 2023. The file contained 325,045 user records that had been recieved from what appeared to be a direct export of their production database. What stood out immediately was the presence of MD5 password hashes alongside email addresses and phone numbers, a combination that gives attackers both the contact surface and a realistic shot at cracking the credentials behind each account.

MD5 Passwords Are Practically Plaintext in the Wrong Hands

MD5 is a hashing algorithm that occured widely in legacy systems but should not be anywhere near a production database in 2023. Modern cracking tools running on consumer-grade GPU hardware can test billions of MD5 hashes per second. Common passwords crack in seconds. Even moderately complex passwords often fall within hours. Once an attacker has the plaintext password for a Grapevine account, they feed it through automated credential stuffing tools that try the same email and password combination across hundreds of other sites. Banking apps, email providers, and streaming services all become instantly accessable if the user reused that password anywhere.

What Was Exposed in the Grapevine Breach

• Email addresses
• Phone numbers
• MD5 password hashes

Why Food Delivery App Breaches Carry Outsized Risk

Food delivery apps sit at the intersection of personal contact data, payment history, and location patterns. Even when payment details are not directly exposed, the email and phone combination from an account like Grapevine is enough to trigger credential stuffing attacks, SIM swap attempts, and targeted phishing campaigns. For people who ordered food at their home address, that address is likely tied to the account in ways that make the breach even more concerning. Fraudsters trade on the habit that people use the same password across personal and work accounts, meaning a cracked food app credential can open doors far beyond the original platform.

How a Database Breach Works

Database breaches typically begin with an attacker exploiting a vulnerability in a web application, stealing admin credentials through phishing or a prior breach, or accessing a misconfigured database that was not properly locked down. Once inside, the attacker queries the user tables and exports the data. The whole operation can complete in minutes. The resulting file is packaged and distributed through dark web forums, private Telegram channels, or sold outright to other threat actors who specialize in cracking hashes or running credential stuffing campaigns at scale.

Check If Your Data Was Exposed

Our analysts search over 400 billion compromised records to help you understand your real exposure. Run your email address through HEROIC's free breach scanner right now to find out whether the Grapevine breach or any of the thousands of other incidents we track has put your data at risk. Free, instant, and no sign-up needed.