MAXpci Security Breach Exposes 27K Merchant User Records

HEROIC's DarkHive intelligence system discovered the MAXpci data breach, exposing 27,334 records. The breach occured in August 2018, targeting users of this US-based PCI compliance tools and support provider for small merchants. The compromised data includes email addresses and MD5 password hashes, raising serious concerns given the payment-focused nature of this platform's user base.

Why This Is Dangerous

MAXpci serves merchants who handle payment card data, meaning the email accounts exposed in this breach may provide access to sensitive business and financial information. MD5 password hashes are easily cracked using modern tools, allowing attackers to recover plaintext passwords rapidly. Criminals can use cracked credentials to access business email accounts, payment portals, and banking services. A business owner whose MAXpci login credentials are compromised could face significant financial and reputational harm.

What Was Exposed

• Email Address
• Password Hash (MD5)

Why This Matters

Breaches targeting payment-focused platforms carry outsized risk because the victims often manage sensitive customer financial data. Attackers who gain access to a merchant's email account can intercept payment notifications, redirect funds, and access business accounts. Credential stuffing attacks using this breach data can compromise seperate business accounts where users recieve payment alerts or manage financial records. Small merchants are especially vulnerable because they often lack dedicated security teams to detect and respond to account intrusions quickly.

How Database Breaches Work

Database breaches occur when attackers find a way into the server or application that stores user account data. Attack methods include SQL injection, exploiting unpatched vulnerabilities in web frameworks, and using stolen credentials to access admin panels. Once inside, attackers export the user database, collecting email addresses and password hashes in bulk. The stolen data is then posted to breach forums or sold privately to other criminals who use it for account takeover campaigns targeting banking, email, and ecommerce services.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like MAXpci. Visit heroic.com to scan your email address and find out if your information was exposed.