The KreaSoft Plus Breach Exposed 4,843 Colombian IT Services Users

In September 2024, KreaSoft Plus, a software development and IT consulting firm based in Cucuta, Norte de Santander, Colombia, suffered a database breach that exposed the personal data of 4,843 users. The stolen records surfaced on dark web forums on September 15, 2024, containing a combination of contact details and password hashes. While bcrypt hashing provides a layer of protection, the exposure of phone numbers and emails alongside those hashes creates a serious ongoing risk for affected users.

Why This Is Dangerous

IT services firms are high-value breach targets because they often hold access to client networks, internal systems, and sensitive business data. A breach of an IT services provider's own user database raises questions about the security posture of the clients they serve. Even with bcrypt-hashed passwords, the combination of email addresses and phone numbers creates a ready-made toolkit for targeted phishing and social engineering attacks against both the affected users and the businesses KreaSoft Plus serves.

What Was Exposed

• Email addresses
• Phone numbers
• Password hashes (bcrypt)

Why This Matters

Even hashed passwords carry real risk when exposed alongside other personal data:

• Offline brute-force attacks: Attackers with bcrypt hashes can run offline cracking attempts against weak or common passwords, potentially recovering them over time.
• Credential stuffing: Users who reuse passwords across multiple services remain at risk even before any cracking occurs, as attackers cross-reference this data with other leaked plaintext databases.
• Phishing and vishing: Phone numbers paired with email addresses enable targeted voice phishing calls and SMS scams using your real name and details.
• Identity theft: Colombian residents face particular risk as local government and banking systems may use email and phone as primary verification methods.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to the backend data storage of a website or application. Common attack vectors include SQL injection -- inserting malicious commands into web forms or URL parameters to extract database contents -- as well as exploitation of unpatched content management system vulnerabilities and compromised administrative credentials. Once inside, attackers can export entire user tables in seconds. The stolen data is then sold or shared on dark web marketplaces, with smaller regional breaches often bundled together to increase their sale value.

Check If You Are Affected

If you ever created an account with KreaSoft Plus or used their services, your email address and phone number may now be in the hands of cybercriminals. Use Heroic's free breach search tool, backed by over 400 billion compromised records, to check instantly whether your data appears in this breach or thousands of others.

Search the Heroic Database Now -- It's Free