How the iSPYETF Database Breach Exposed 2,060 Investor Logins

HEROIC analysts identified a dataset from iSPYETF, a US subscription service offering ETF and stock market commentary, that was breached on August 26, 2018. The incident exposed 2,060 records containing email addresses and bcrypt-hashed passwords, later posted on a hacking forum.

Why the iSPYETF Breach Is Dangerous

Bcrypt is a strong hashing method, so most of the passwords in this file are not easy to crack outright. Still, any password that was short or commonly used remains vulnerable to a determined attacker with enough computing time, and once recovered, it pairs directly with a real email address that belongs to someone actively engaged in financial markets, a group attackers often target for brokerage account takeovers and phishing scams.

What Was Exposed

• Email addresses
• Bcrypt password hashes

Why This Matters

Cracked credentials from this breach can be used for credential stuffing, testing the same login against brokerage platforms, banking sites, and email accounts. Because subscribers to a financial analysis service often hold investment accounts elsewhere, a successful match can lead to account takeover, financial fraud, or identity theft with real monetary consequences.

How Database and Combolist Breaches Like This Happen

This breach traces back to a direct compromise of iSPYETF's subscriber database, most likely through a vulnerability in the platform's website or login system. Once attackers copied the table of emails and password hashes, they packaged the data into a combolist, a compiled file built for easy reuse and resale on hacking forums. Combolists like this one keep circulating for years after the original breach, which is why 2018 data is still worth checking today.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this iSPYETF breach. Run a scan now, and change any password you may still be reusing from 2018.