BREAKING: Moda Angeli Exposes 16,978 Records in Database Combolist Incident

A data breach involving Moda Angeli, a now-defunct Indian modeling and casting agency, exposed nearly 17,000 user records back in August 2018. The dataset surfaced on a well-known hacking forum and has continued to circulate since then, putting affected users at ongoing risk. If you ever created an account with this agency, your credentials may still be out there.

Why This Is Dangerous

What makes this breach particularly alarming is that the passwords were stored and leaked in plaintext. There was no hashing, no encryption, nothing standing between an attacker and immediate access to your password exactly as you typed it.

Credential stuffing attacks are the most direct threat here. Attackers take these email and password combinations and try them against popular services like Gmail, banking apps, and social media platforms. If you reused that password anywhere, those accounts are at risk too.

Even though Moda Angeli no longer operates, the data doesn't dissapear with the company. Combolists like this one get traded, merged with other datasets, and recieved by new threat actors years after the original breach occured.

What Was Exposed

• Email addresses
• Plaintext passwords (unencrypted, fully readable)
• Account usernames
• User registration details
• Potential casting or agency profile information
• Account creation timestamps
• Associated contact or application data

Why This Matters

Moda Angeli operated across major Indian cities including Mumbai, Hyderabad, Pune, Delhi, and Bangalore. The 16,978 individuals in this dataset were likely aspiring models, actors, and creative professionals who trusted the agency with their personal information. Many of them may not even know their data was ever compromised.

Breaches from companies that have since shut down are especially tricky because there is no organization left to send notifications or offer remediation. The affected users are entirely on their own, which is exactly why checking your exposure and changing old passwords matters so much.

How Database Breaches Work

A database breach typically happens when attackers find a vulnerability in a web application, an exposed server, or an unsecured database endpoint. Once inside, they can copy out the entire user table in a matter of minutes, sometimes without triggering any alerts.

In cases like Moda Angeli, where the passwords were stored in plaintext, the breach is immediately actionable for attackers. There is no cracking step required. The database itself becomes a ready-made credential list that can be loaded into automated attack tools.

These dumps are then packaged as combolists and sold or freely shared on dark web forums, where they get combined with data from other breaches to create massive, cross-platform attack libraries. This is seperately a growing problem from the original breach itself.

Check If You Were Affected

If you ever registered with Moda Angeli or used the same email and password combination on other sites, you should check your exposure right away. Use HEROIC's free breach checker at heroic.com to find out if your credentials have appeared in this or any other known data breach. Change any reused passwords immediately and enable two-factor authentication wherever possible.