The MLB.com Leak Could Unlock More Than Just Your Ticket Account

HEROIC analysts identified a database breach tied to MLB.com, dated September 13, 2015. The scale here is small: just 26 accounts, but the exposure is direct, pairing email addresses with plaintext passwords.

Why This Is Dangerous

Because the passwords in this leak are plaintext, no cracking is required. Anyone in this small group has their exact login sitting exposed, and that same password may well protect other accounts far more sensitive than a sports website login, including email, banking, or shopping accounts.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

A password used for an MLB.com account is often the same password used elsewhere, since people tend to reuse passwords across low-stakes and high-stakes accounts alike. Attackers take exposed email and password pairs like these and run them through automated credential stuffing tools, testing the same login against banks, email providers, and other retailers until one works. A small leak like this one is just as usable for that purpose as a much larger one.

How Database Breaches Like This Happen

This incident is classified as a database breach, meaning a set of account records was accessed directly from a backend system rather than gathered from individual users one at a time. Small, quiet breaches like this often go unnoticed for years, circulating on forums and being combined with other leaked data long after the original incident occurred.

Check If You Are Affected

If you have ever had an MLB.com account, or reused a password from that time period elsewhere, it is worth checking your exposure. HEROIC's free breach scanner searches a database of more than 400 billion breached records to tell you instantly if your email address has been compromised.