Researchers Link 196,748 Stolen Passwords to Grp.funformobile Breach

HEROIC analysts recieved intelligence on a database breach tied to Grp.funformobile, a mobile content platform offering ringtones and wallpapers. The breach, dated April 2021, exposed 196,748 records containing email addresses and plaintext passwords. The data surfaced in dark web channels and remains actively circulated among threat actors.

Plaintext Passwords Make Every Account Instantly Vulnerable

When passwords are stored without hashing or encryption, attackers gain immediate, usable credentials. With the Grp.funformobile breach, every one of the 196,748 exposed passwords is accessable to anyone who obtains the dataset. There is no cracking required, no computational effort. Attackers can log directly into accounts using the stolen email and password pairs.

What Was Exposed in the Grp.funformobile Breach

• Email Address
• Plaintext Password

Why Plaintext Password Leaks Create Lasting Risk

Most people reuse passwords across multiple services. The Grp.funformobile breach is partcularly dangerous because the passwords are immediately usable, meaning attackers can run credential stuffing campaigns against banking, email, and social media accounts without any additional processing. Identity theft and account takeover are direct, likely outcomes for affected users.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend database, typically through SQL injection, misconfigured cloud storage, or compromised administrative credentials. Once inside, they extract tables containing user records. In this case, the Grp.funformobile database stored passwords in plaintext rather than using a secure hashing algorithm, meaning the stolen data required no further processing before it could be used.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to check whether your email or passwords appeared in the Grp.funformobile breach or thousands of others. Run a free scan today to find out if your credentials are circulating on the dark web.