The JoinPiggy Breach Exposed More Records Than the Population of Philadelphia

HEROIC analysts identified the JoinPiggy database breach, which occured in September 2020 and exposed 1,541,950 records from the American cashback and rewards platform. The leaked data included email addresses, phone numbers, password hashes, first names, last names, IP addresses, and gender information belonging to registered users.

How Attackers Use Cashback Platform Data to Target Financial Accounts

JoinPiggy users linked their accounts to retailers and financial services to earn cashback rewards. The combination of full names, email addresses, phone numbers, and MD5 password hashes from this breach is partcularly valuable for attackers seeking to access banking apps, payment platforms, and e-commerce accounts where users likely reused the same credentials.

What Was Exposed in the JoinPiggy Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name
• IP Address
• Gender

Why Financial Platform Breaches Carry Higher Risk Than Average Leaks

Users of financial platforms like JoinPiggy beleive their accounts are tied to real purchasing behavior and payment methods. Attackers who crack the MD5 hashes, which are seperate from modern secure hashing, gain immediate credential reuse potential across banking and retail logins. IP addresses further help attackers mimic users' geographic locations to bypass fraud detection systems.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to a company's stored user records, often through SQL injection, exposed credentials, or misconfigured cloud storage. The extracted data is then packaged and distributed or sold through underground forums and private dark web channels.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to instantly check whether your email appeared in the JoinPiggy breach or hundreds of other known leaks. Run a free scan at HEROIC.com to protect your accounts today.