How a Database Leak Exposed 225,697 GratisGodis.se Accounts in 2016

HEROIC analysts first spotted the GratisGodis.se database circulating in underground forums and private Telegram channels in late 2022, years after the original incident occured on December 14, 2016. The Swedish "free candy" rewards site had 225,697 user records pulled from its database, including email addresses, usernames, and passwords stored in plain text and MD5 format. The data was quietly being passed between threat actors who were packaging it alongside other older Swedish breaches to build richer target profiles.

Why Exposed Passwords From GratisGodis.se Put Accounts at Risk

When passwords are stored in plain text or weak MD5 hashing, attackers can crack or directly read them without any special effort. Anyone whose GratisGodis.se password matches a password they use on banking, email, or social media accounts is partcularly vulnerable to account takeover. Credential stuffing tools can test these combinations across hundreds of sites in minutes, and this kind of reuse is how most account takeovers happen.

What Was Exposed in the GratisGodis.se Breach

• Email addresses
• Usernames
• Passwords (plain text and MD5-hashed)

How Old Breaches Like This One Keep Causing Real Harm

A breach from 2016 can still cause damage in 2024 because people rarely change passwords after an incident they never heard about. Threat actors actively seek out older, lesser-known breaches beleiving victims have let their guard down. The GratisGodis.se records have been spotted in credential stuffing lists, identity verification attacks, and bundled data packages sold on dark web markets, making the exposure far more dangerous than it may appear at first glance.

How a Database Breach Works

A database breach happens when an attacker gains unauthorized access to a website's backend database, either by exploiting a software vulnerability, using stolen administrator credentials, or taking advantage of a misconfigured server. Once inside, they can copy the entire user table, which contains everyone who ever registered on the site. The stolen file is then downloaded and later sold or shared in criminal communities. Victims typically have no idea their information was taken until the data shows up in a breach notification or an unfamiliar login alert.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you exactly which breaches contain your email address. If your data was part of the GratisGodis.se leak or any other incident, you'll know in seconds. Run a free check at HEROIC and take the first step toward protecting your accounts today.