Account Takeover Just Got Easier Because of the Lloyd Breach: 26,244 Plaintext Passwords Exposed

HEROIC analysts flagged the Lloyd breach after observing the dataset recieved renewed attention on dark web channels where older credential dumps are traded and repurposed. The breach occured in May 2016, exposing 26,244 user accounts from the Indian shopping platform mylloyd.com. What makes this breach seperate from others of its era is the password storage method: the credentials were stored in plain text, meaning anyone with the data has immediately usable, unencrypted passwords rather than hashed values that require cracking first.

What Attackers Can Do With Lloyd Plaintext Passwords

Plaintext passwords are the most dangerous type of exposed credential because they require no additional work to use. An attacker with the Lloyd dataset can immediately attempt those exact passwords against the victims' email accounts, other shopping sites, banking portals, and workplace systems. Shopping platform users often register with their primary email address and a familiar password they use across many sites, making this data partcularly effective for credential stuffing and account takeover at scale. No cracking tools are needed, the passwords work as-is.

What Was Exposed in the Lloyd Breach

• Email addresses
• Passwords (stored in plaintext, unencrypted)

Why Plaintext Passwords from a Shopping Breach Lead Directly to Financial Fraud

When a shopping platform stores passwords in plain text, a single breach hands attackers a ready-to-use key ring. The 26,244 people affected by the Lloyd breach are at direct risk of account takeover on any service where they reused their password. Financial fraud and identity theft follow quickly when attackers access an email inbox, because that inbox can then be used to reset passwords on banks, payment apps, and other accounts. Even years after the original breach, these plain text passwords continue to be beleived valuable in underground markets because password reuse remains widespread among consumers.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to a platform's user database. Once inside, they copy the stored records and move them offline for use or sale. When a site stores passwords in plain text instead of hashing them, the data is immediately usable without any additional processing. This is a serious security failure on the part of the platform operator, but the consequences fall entirely on the users whose credentials were exposed. Breaches like Lloyd are especially damaging because victims have no way of knowing their specific password is in the hands of attackers unless they are notified directly.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records, including the Lloyd shopping platform database. If your email address was part of this breach, you need to know now so you can change your password everywhere you've used it. Visit HEROIC.com to run your free scan in seconds.