The iMoveis Leak Quietly Surfaced: 25,064 Passwords Exposed

HEROIC analysts identified a dataset tied to iMoveis, a now-defunct Portuguese free advertising platform for property listings, dating to August 24, 2018. The breach exposed 25,064 records, including email addresses and plaintext passwords, which later surfaced on a hacking forum.

Why the iMoveis Leak Is Dangerous

Because the passwords in this breach were never encrypted or hashed, anyone who gets hold of this dataset has an immediately usable login for every one of the 25,064 accounts involved. There is no cracking step required, which makes this data far more dangerous than a typical hashed password breach.

What Was Exposed in the iMoveis Breach

• Email addresses
• Plaintext passwords

Why This Matters

A property listing site might seem low stakes, but the password someone used there is often the same one they use for email, banking, or shopping. Attackers count on that overlap, feeding leaked credentials into credential stuffing tools that can lead to account takeover, identity theft, and financial fraud far beyond the original iMoveis account.

How a Database and Combolist Breach Like This Works

This incident is classified as both a database breach and a combolist. The data was taken directly from iMoveis' own database, then shared publicly as a combolist, a simple file pairing each email address with its plaintext password, built specifically so criminals can run it through automated login tools against other websites.

Check If You Are Affected

If you ever had an account on iMoveis, or you reuse passwords across sites, it's worth checking now rather than waiting. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including this one, so you can find out quickly and update any passwords still at risk.