Researchers Trace 21,596 Plaintext Passwords to the Loady.DE Breach

HEROIC analysts identified a dataset from Loady.DE, a now-defunct German software repository and download portal, circulating on a hacking forum. Dated around August 21, 2018, the dataset contains 21,596 records, each pairing an email address with a password stored in plaintext.

Why This Is Dangerous

Plaintext storage means there is no hashing standing between an attacker and a working password. Anyone who accessed this file could log in with a stolen email and password immediately, with no cracking or guessing required, making the exposure just as dangerous today as it was the moment the file leaked.

What Was Exposed in the Loady.DE Breach

• Email addresses
• Plaintext passwords

Why This Matters for the 21,596 People Affected

People who downloaded software from Loady.DE may have used the same password on far more sensitive accounts, like email or banking. Because these passwords were never hashed, they remain instantly usable by anyone who has the file, making this dataset a reliable source for credential stuffing, account takeover, identity theft, and financial fraud years after the original breach.

How This Database Breach Happened

This incident is classified as a database and combolist breach, meaning attackers obtained a direct copy of Loady.DE's user table, likely through a vulnerability in the site's infrastructure, and packaged the emails and plaintext passwords for distribution on a hacking forum. Because the passwords were never protected with hashing in the first place, this dataset has remained fully usable for credential stuffing ever since.

Check If You Are Affected

To find out if your email address or password appears in this leak or any other, run a free scan with HEROIC's breach checker, which searches a database of more than 400 billion leaked records.