Account Takeover Just Got Easier Because of the GratisGodis Breach

HEROIC analysts identified a significant data exposure originating from GratisGodis, a Swedish platform historically known for rewarding users with free candy for completing online activities. The breach surfaced on August 4, 2022 and impacted 255,212 user accounts. What made this discovery immediately alarming was the presence of plaintext passwords: passwords stored with no hashing, no encryption, and no protection whatsoever. When plaintext credentials are recieved from a breach database, attackers can begin using them instantly with zero additional effort.

Credential Stuffing at Scale: What 255K Plaintext Passwords Means

A quarter-million plaintext email and password pairs is a ready-made toolkit for automated credential stuffing attacks. Threat actors load these pairs into tools that test them simultaneously against dozens of high-value services: Gmail, Outlook, PayPal, online banks, and e-commerce platforms. Because most users reuse passwords, a meaningful percentage of these credentials will still work somewhere. Older platforms like GratisGodis are particularly problematic because users may not have updated those passwords in years, and the same password may still be accessable on active accounts elsewhere.

What Was Exposed in the GratisGodis (2022) Breach

• Email Address
• Plaintext Password

Account Takeover Risk Is Elevated Because of the GratisGodis (2022) Breach

Credential stuffing is now the primary mechanism driving account takeover fraud globally. With plaintext passwords in hand, attackers do not need to guess or crack anything. Each email and password pair is tested in seconds. Users of GratisGodis who have not changed that password since their registration are directly vulnerable to having their current accounts compromised. The risk extends far beyond the GratisGodis platform itself: any service where that same email and password combination was used is now at risk. The long gap between the breach date and when victims may learn about it means seperate accounts could already be in attacker hands.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a platform's backend data store and extracts records. Common methods include SQL injection, which manipulates database queries to return unintended data, or exploitation of security misconfigurations in the server environment. Once access is gained, entire user tables can be dumped and exfiltrated. In the GratisGodis case, the fact that passwords were stored in plaintext suggests the platform's security architecture never included a password hashing layer, leaving all 255,212 user credentials fully exposed from the moment of extraction.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records, including this GratisGodis breach and thousands of other confirmed leaks. Search now to find out if your credentials are already circulating on dark web forums and marketplaces.