The SMF Corp Breach: 17,276 Plaintext Passwords Exposed in 2018

HEROIC analysts identified a data breach affecting La Secte des Magiciens Fous (SMF Corp), a French-language Magic: The Gathering webzine and community platform. The breach first surfaced in October 2018, exposing records belonging to 17,276 users. What makes this incident alarming is that the leaked data included plaintext passwords -- meaning the site stored user passwords with zero encryption or protection. These credentials were found circulating in underground combolists and credential stuffing toolkits used by attackers across the globe.

Why This Is Dangerous

Plaintext passwords represent one of the most serious security failuers a website can make. Unlike hashed passwords, plaintext credentials require no cracking -- attackers can take them directly and use them to log into accounts immediately. In 2018, there was simply no acceptable reason for any website to store passwords this way. Magic: The Gathering enthusiasts and community forum members tend to reuse the same username and password across many platforms, which means a breach on a niche gaming webzine could directly unlock email accounts, work logins, and financial portals. Seven years after this breach, those credentials are still actively traded and tested against live platforms around the world.

What Was Exposed

• Email addresses -- 17,276 unique user accounts
• Plaintext passwords -- stored and leaked with no encryption or hashing applied
• Breach origin: Database dump combined with combolist distribusion
• Country of origin: France
• Date first observed: October 16, 2018

Why This Matters

Small community sites are consistently overlooked in breach discussions, but they create a massive attack surface. La Secte des Magiciens Fous had fewer than 20,000 users -- the kind of breach that rarely makes news. That is exactly why it is valuable to attackers. Users are less likely to ever be notified, less likely to change their passwords, and more likely to have reused those same credentials elsewhere. This breach is a clear example of how old data keeps causing real harm long after the original incident is forgotten.

How Database Combolist Breaches Work

When attackers compromise a website database, they extract the user table containing login credentials. If the site stored passwords in plaintext, the attacker immediately has ready-to-use username and password pairs requiring no additional work. These pairs get compiled into combolists -- massive text files with millions of credential combinations. These lists are sold, shared, and traded across hacking forums and private Telegram channels. Automated tools then test these credentials against popular services like Gmail, PayPal, and banking apps in a process called credential stuffing. Even a small breach of 17,000 accounts contributes meaningfully to attacks hitting much larger platforms.

Check If You Are Affected

If you ever had an account on La Secte des Magiciens Fous (SMF Corp) or used the site at smfcorp.net, your email address and password may have been exposed. HEROIC's free breach scanner checks your email against a database of over 400 billion leaked records -- one of the largest collections of breach data ever assembled. Even if you changed your password years ago, your old credentials may still be in circulation and used in active attacks today. Run a free scan at HEROIC to find out exactly what data about you is out there.