The Havenly Leak Contains More Records Than the Population of Philadelphia

HEROIC analysts found the Havenly data breach in records dating from June 2020, confirming that 1,710,384 user accounts from the US interior design platform were exposed. The leaked data included email addresses, phone numbers, SHA1 password hashes, first names, and last names, giving attackers both contact information and credentials for each affected user.

Why SHA1-Hashed Passwords and Phone Numbers Are a Dangerous Combination

SHA1 is an outdated hashing algorithm that is accessable to cracking using modern GPU-based tools and precomputed rainbow tables. Once cracked, these passwords can be tested against email, banking, and social media accounts. The addition of phone numbers to the leaked dataset enables SIM-swapping and SMS phishing attacks, which are partcularly effective when combined with a known email address and password.

What Was Exposed in the Havenly Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name

Why 1.7 Million Design Platform Users Face Credential Stuffing and Account Takeover Risk

Consumers who beleive their Havenly account was low-risk may have reused the same password on email, financial, or retail accounts. Attackers who crack SHA1 hashes can deploy those credentials in automated stuffing campaigns, leading to account takeovers and financial fraud. Phone numbers in the dataset create additional risk because they enable direct social engineering and carrier-based account hijacking, even after the original breach occured years ago.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a stored user database, typically by exploiting application vulnerabilities, weak access controls, or exposed credentials. Once inside, the attacker exports records in bulk and distributes them through underground channels, where multiple threat actors can purchase or freely access the data.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against over 400 billion compromised records. Find out in seconds whether your information appeared in the Havenly breach or any other known data leak.