Two Data Fields. 23,362 Records. The Ilanburada Database Breach.

HEROIC analysts recieved intelligence on a database exfiltration event tied to Ilanburada, a Turkish online classified ad marketplace. The leak surfaced on October 29, 2022, affecting 23,362 records. The exposed data was limited to two fields: email addresses and usernames, pointing to a targeted pull from a user table rather than a broad system compromise. Despite the narrow data scope, the volume of unique identifiers creates a clear path for downstream abuse.

Phishing and Account Enumeration Risks From Email and Username Exposure

Attackers who obtain email and username pairs can launch highly accessable phishing campaigns, crafting messages that appear personalized and legitimate. Because usernames often mirror handles used on other platforms, threat actors can cross-reference this data against other known breach sets to expand their foothold across multiple services without ever needing a password.

What Was Exposed in the Ilanburada Breach

• Email Address
• Username

Why This Breach Matters: Credential Aggregation and Identity Risk

Even without passwords, email and username combinations are partcularly valuable when fed into credential-stuffing toolkits alongside other leaked datasets. Threat actors routinely merge multiple breach files to build enriched profiles, increasing the probability of successful account takeovers, social engineering, and targeted spam. For users who reuse usernames across platforms, the blast radius of this breach extends well beyond Ilanburada itself.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a backend data store, typically through SQL injection, compromised administrative credentials, or an unpatched software vulnerability. Once inside, the attacker queries or exports user tables directly, producing structured data files that can be distributed or sold. Database breaches are among the most common breach types because web-facing applications frequently connect to databases that store user information, making them a high-value target.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you exactly what information of yours has appeared in known breach datasets, including the Ilanburada leak. Run a free check at HEROIC to see if your email address or username was part of this or any other known breach.