The MarketsMojo Leak Contains More Records Than the Population of Miami

HEROIC analysts identified the MarketsMojo database breach, which occured in March 2021 and exposed 450,949 records from the Indian investment platform. The leaked data included email addresses, phone numbers, usernames, and bcrypt password hashes. This breach was catalogued and cross-referenced against HEROIC's breach intelligence database, which now spans more than 400 billion records.

Financial Platform Data Gives Attackers Direct Access to Investment Accounts

When a financial investment platform is breached, the stakes are higher than a typical service breach. Attackers who recieved access to email addresses and phone numbers from MarketsMojo can attempt to reset account passwords, intercept two-factor authentication codes via SIM swapping, or launch phishing campaigns tailored to investment platform users. Even bcrypt-hashed passwords present risk if users chose weak or common passwords that are accessable through dictionary attacks.

What Was Exposed in the MarketsMojo Breach

• Email Addresses
• Phone Numbers
• Usernames
• Password Hashes (bcrypt)

Why the MarketsMojo Breach Is a Serious Financial Risk

With 450,949 users affected, this breach represents a large pool of Indian investors whose contact information is now in the hands of threat actors. The combination of email and phone number data makes it partcularly effective for targeted phishing, smishing, and social engineering attacks designed to steal investment account access or transfer funds. Credential stuffing tools can also test these email and password combinations against other financial services where users may have reused the same login.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to an organization's backend data store. This can happen through SQL injection vulnerabilities, compromised administrative credentials, or misconfigured server permissions. Once access is obtained, the attacker exports user tables containing personal information and hashed passwords, then takes that data offline for cracking or sale on dark web markets.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records across thousands of known breaches, including MarketsMojo. Enter your email address at HEROIC.com to instantly check whether your credentials were exposed and take action to secure your accounts before attackers do.