The GrooveList Leak: 75,629 Accounts Exposed. Yours Might Be One.

HEROIC analysts identified a leaked dataset from GrooveList, a United States based music licensing platform for media and entertainment professionals, shared on a Telegram channel. The breach was discovered on October 30, 2024, and exposed 75,629 records containing email addresses, first and last names, birthdays, gender, and password hashes protected with bcrypt.

Why This Is Dangerous

Bcrypt is a strong hashing algorithm, so these passwords are harder to crack than older methods. But the combination of a birthday, gender, full name, and email address gives attackers a detailed personal profile that can be used to answer security questions, pass identity checks, or craft convincing phishing messages that reference real personal details to earn a victim's trust.

What Was Exposed

• Email addresses
• First names
• Last names
• Birthdays
• Gender
• Password hashes (bcrypt)

Why This Matters

A birthday combined with a full name and email address is exactly the kind of information used to verify identity on banking sites, medical portals, and customer service calls, which makes this leak useful for identity theft well beyond GrooveList itself. If any of the underlying passwords are eventually cracked or match ones reused on other sites, this data can also feed credential stuffing attempts, leading to account takeover and financial fraud.

How Database Breaches Work

This incident is classified as a database breach, meaning attackers gained direct access to GrooveList's backend systems and extracted user records in bulk, most likely through an unpatched vulnerability or stolen administrative access. Once obtained, the dataset was shared on a Telegram channel, a fast and low-effort way for threat actors to distribute stolen data widely without needing to negotiate a sale on a private forum.

Check If You Are Affected

If you have a GrooveList account, it is worth checking whether your information appears in this leak. HEROIC's free breach scanner searches more than 400 billion leaked records, including this dataset, so you can see your exposure and take steps to protect your identity and accounts.