HEROIC Analysts Found Kickstarter’s 793,873 Records Still Circulating

HEROIC analysts identified a database breach tied to Kickstarter, the crowdfunding platform, and found this subset of the data, 793,873 records, still circulating in credential compilations today. The exposed records include email addresses, password salts, and SHA1 password hashes.

Why the Kickstarter Breach Still Matters

SHA1 with a unique salt per password is considerably more resistant to cracking than unsalted hashes like MD5, since attackers cannot use precomputed lookup tables against the entire data set at once. However, SHA1 is no longer considered a strong hashing algorithm, and weak or common passwords can still be cracked individually, especially with modern computing power.

What Was Exposed in the Kickstarter Breach

• Email addresses
• Password salts
• Password hashes (SHA1)

Why This Matters

Once a password hash is cracked, even a salted one, it becomes usable in the same way a stolen plaintext password would be: paired with the account's email address to attempt logins elsewhere. Because this data keeps resurfacing in newer credential compilations, it continues to be tested against other services years after the original breach, which is why old accounts and reused passwords remain a genuine risk today.

How This Database Breach Happened

This breach fits the pattern of a direct database compromise, where an attacker gained access to Kickstarter's backend systems and extracted email addresses along with the salts and hashes used to protect user passwords. Using per-password salts was a stronger security choice than many breaches HEROIC tracks, but it does not make the data harmless, only slower to exploit.

Check If You Are Affected

If you ever created a Kickstarter account, or you reuse passwords across crowdfunding and other platforms, it's worth checking your exposure. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can find out where your email address has appeared and change any passwords that are still at risk.