Were You One of the 75 Accounts in This LockBit Panel Leak?

HEROIC analysts found a database tied to LockBit's own affiliate panel, distributed as a SQL dump dated April 29, 2025. Inside were 75 affiliate and administrator accounts, each with a username, a plaintext password, and a Bitcoin address used for collecting ransom payments. This data came from the panel's own internal records rather than from any outside victim organization. The only way to know if you're affected is to scan your email.

Why a Small Database Can Still Matter

With only 75 accounts, this file is tiny compared to most leaks HEROIC tracks, but every entry pairs a readable password directly with a username and a Bitcoin address. For anyone whose credentials appear here, a reused password is just as exploitable as in a much larger leak.

What Was Exposed in the LockBit Panel Database

• Username: identifies the specific account tied to each record for direct login attempts.
• Plaintext Password: readable immediately, letting anyone try it without cracking anything.
• Bitcoin Address: ties the account to the cryptocurrency wallet it used, useful for tracing related activity.

Why Reused Passwords Are Still the Main Risk

If any of these usernames or passwords were reused on other platforms, those accounts are exposed too. A readable password gives an attacker immediate access, no cracking or guessing required, to whatever else it unlocks.

How This Kind of Database Leak Happens

A database breach like this is taken directly from a system's own internal records, in this case an administration panel, rather than pieced together from older leaks. Once copied, it was distributed on Telegram and criminal forums for anyone to access.

How to Respond to the LockBit Panel Leak

Scan your email to check your own broader exposure, and if you recognize any of the credential patterns here, change that password everywhere it has been reused. This applies to personal and work email alike.