Our Analysts Found MatrixChart Systems’ Breach: 10,237 Records Exposed

HEROIC analysts found a dataset from MatrixChart Systems, a Singapore-based company that makes financial charting and technical analysis software for traders and investors, circulating on a well-known hacking forum. The data was posted on August 26, 2018, and contains 10,237 user records consisting of email addresses and phpass password hashes.

Why This Is Dangerous

Phpass hashing is stronger than older methods like MD5, but it is not unbreakable. Attackers with enough computing power and a list of common passwords can still crack a meaningful share of these hashes offline, away from any rate limiting or lockout protection the original site might have had. Anyone using a weak or common password on MatrixChart Systems is at real risk of that password being recovered.

What Was Exposed in the MatrixChart Systems Breach

• Email addresses of registered MatrixChart Systems users
• Passwords stored as phpass hashes

Why This Matters

Traders and investors who used MatrixChart Systems for financial charting often reuse the same login across trading platforms, brokerages, and financial apps. If a cracked password from this breach matches a password used elsewhere, an attacker can use it for credential stuffing, potentially leading to account takeover, identity theft, or direct financial fraud against accounts that hold real money.

How This Database Breach Turned Into a Combolist

This incident is classified as both a database breach and a combolist. The 10,237 records were taken directly from MatrixChart Systems' own database, likely through a flaw in the site's security, and then repackaged into a combolist, a simple file that pairs each email with its matching password. Combolists spread quickly on hacking forums because anyone can load one into automated login software and test it against dozens of websites at once, with no special technical skill required.

Check If You Are Affected

If you have ever used MatrixChart Systems or reuse the same password across financial or trading accounts, it is worth checking your exposure. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to instantly show you if your email address has appeared in this breach or any other.