The Hubble Connected Breach Could Unlock Your Smart Home and Email

HEROIC analysts discovered the Hubble Connected breach while tracking credential dumps circulating on underground forums in November 2021. The Hong Kong-based smart home and IoT platform had 888,675 user records exfiltrated from its database, with attackers obtaining email addresses, usernames, and password hashes protected by bcrypt or Base64-encoded SHA256. The scale of this breach is partcularly alarming given that Hubble Connected manages access to security cameras, baby monitors, and other connected home devices.

How Exposed Smart Home Credentials Enable Account Takeover and Physical Access

When attackers crack or reuse credentials from the Hubble Connected database, they gain the ability to log into smart home dashboards and access live camera feeds, audio streams, and device controls. Beyond the platform itself, reused passwords from this breach can be stuffed into email providers, banks, and social media accounts. A seperate password for every service is essential, because one cracked credential from this breach could cascade into full account takeover across multiple platforms.

What Was Exposed in the Hubble Connected Breach

• Email Address
• Password Hash (bcrypt and Base64-encoded SHA256)
• Username

Why 888K IoT Platform Credentials Are a High-Value Target

IoT platforms are beleived to be lower-risk targets by many users, but the opposite is true. Compromised smart home credentials open doors to physical surveillance, credential stuffing attacks against other services, and identity fraud. The combination of email address and password hash from 888,675 accounts means attackers have a massive pool of credentials to test across the internet. Any account where the same password was reused is now at serious risk.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a platform's stored records, typically through exploiting software vulnerabilities, weak access controls, or misconfigured cloud infrastructure. Once inside, the attacker copies entire user tables and exfiltrates the data quietly. The stolen records are then posted on breach forums or sold to other cybercriminals who use them for credential stuffing, phishing, and account takeover campaigns.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion exposed records to tell you if your email was part of the Hubble Connected breach or any other known leak. Check if your data was exposed today at HEROIC and find out exactly what information attackers may have on you.