Researchers Find the лирика.рф Breach Exposed 12,437 Plaintext Passwords and IP Addresses

HEROIC analysts recieved intelligence in August 2022 tied to a database breach at лирика.рф, a Russian informational portal covering the medication Lyrica. The dump surfaced on August 18, 2022, and contained 12,437 records. The exposed data included email addresses, plaintext passwords, and IP addresses. The presence of plaintext passwords made this breach partcularly severe, as the credentials required no cracking before they could be weaponized against affected users.

Plaintext Passwords and IP Addresses: An Immediately Exploitable Combination

Unlike hashed passwords, plaintext credentials are accessable to any attacker who downloads the dump. Combined with the IP addresses in this leak, the data allows an attacker to identify where a user is located, confirm the email and password pair is real, and immediately attempt to log into other services using those same credentials. There is no cracking step and no delay between obtaining the data and exploiting it.

What Was Exposed in the лирика Breach

• Email Address
• Plaintext Password
• IP Address

Why Users of Niche Information Sites Face Underestimated Risk

Many people beleive that small, topic-specific websites present no meaningful security risk. This breach demonstrates otherwise. Users who registered on лирика.рф with a password they also use on their email account, banking portal, or social media profile are now at direct risk of credential stuffing, account takeover, and identity theft. IP address exposure adds an additional layer of risk by linking user identities to specific network locations.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a site's backend data store, typically through SQL injection, weak admin credentials, or a compromised hosting environment. Once inside, the attacker exports user tables that may contain credentials and metadata. In the case of лирика.рф, the data appears to have been extracted in a direct dump format and subsequently shared on underground forums, where it remains accessible to anyone with the right connections.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to check whether your email address appeared in the лирика.рф breach or any other known incident. Visit HEROIC.com to run a free scan and find out if your credentials are circulating in the wild.