VPN Users at Risk: The Hide My Ass Leak Exposed 50,283 Accounts

HEROIC analysts identified a 2015 breach of Hide My Ass, the VPN service, that exposed 50,283 accounts. The leaked data includes email addresses, usernames, IP addresses, and passwords protected with a mix of IPB and unidentified hashing methods.

Why the Hide My Ass Leak Is Dangerous

People use VPN services specifically to protect their privacy, which makes a breach like this especially damaging. The exposed IP addresses undercut exactly the kind of anonymity users were paying for, while the password hashes involved use older schemes that are increasingly crackable with modern tools.

What Was Exposed in the Hide My Ass Breach

• Email addresses
• Usernames
• IP addresses
• Password hashes (IPB and unknown formats)

Why This Matters

If your VPN password was cracked and reused elsewhere, attackers can use it for credential stuffing against your email or other online accounts. The exposed IP addresses also raise the stakes for anyone who relied on Hide My Ass specifically to keep their online activity private, since that link between identity and IP address is exactly what a VPN is meant to prevent.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers extracted user records directly from Hide My Ass's systems. Breaches involving VPN providers tend to draw sustained interest from data traders precisely because the affected users were trying hard to stay private, making the data more valuable on underground markets.

Check If You Are Affected

If you have ever had an account with Hide My Ass, checking your exposure is a quick way to protect yourself. HEROIC's free breach scanner searches more than 400 billion leaked records, including this breach, to show you exactly what was exposed.