Researchers Find 109,000 Stolen Logins From the Lyrics Mania Breach

HEROIC analysts identified the Lyrics Mania breach while cataloguing entertainment site incidents where plaintext password storage had occured. In December 2017, the US-based lyrics website Lyrics Mania lost 109,215 user records in a database compromise. The stolen data included email addresses, usernames, and passwords stored in plaintext, meaning every password in the database was immediately readable to anyone who accessed the records. Despite multiple attempts to contact Lyrics Mania about the incident, the site never responded, leaving users unaware that their data had been taken.

Why Usernames and Plaintext Passwords Are Ready-Made Attack Tools

When a breach includes usernames alongside plaintext passwords, attackers get more than just an email-and-password pair. They also learn which username the person prefers, a detail that many people reuse across multiple websites. This makes credential stuffing attacks more effective because criminals can try both the email and the username as login identifiers against other platforms. Financial accounts, social media, and email services are all partcularly vulnerable when someone uses the same username and password combination in multiple places.

What Was Exposed in the Lyrics Mania Breach

• Email Address
• Username
• Plaintext Password

Why Entertainment Site Breaches Still Pose a Real Threat

Lyrics sites and entertainment platforms may seem like low-stakes targets, but they often have large user bases and weak security practices. Users who created an account on Lyrics Mania years ago may have forgotten about it entirely, while continuing to use the same password on far more sensitive accounts. Credential stuffing, account takeover, and identity theft are all real outcomes from a breach where plaintext passwords were stored without any protection. The Lyrics Mania records have been in circulation since 2017 and seperate attacker groups continue to test them against active accounts using automated tools.

How a Database Breach Works

A database breach occurs when an attacker finds a weakness in a website and extracts stored user data in bulk. The attacker copies the entire database without alerting the site. Stolen records surface on underground forums and get used in automated attacks against other platforms.

Check If Your Data Was Exposed

HEROIC provides a free breach scanner powered by over 400 billion records from thousands of known incidents. Enter your email address to check whether your data appeared in the Lyrics Mania breach or any other event in our database. Stay a step ahead of attackers who may already have your credentials.