Our Analysts Found Niccolo Ammaniti Credentials on Hacking Forums

HEROIC analysts found the Niccolo Ammaniti breach circulating in a larger credential compilation on an underground hacking forum. The breach originally occured in August 2018 and affected the official Italian website dedicated to the works of author Niccolo Ammaniti. A total of 40,972 user records were exposed, including email addresses and passwords hashed with PHPass, a format that, while better than plaintext, is considered weak by current security standards and can be cracked with modern tools. What made this one notable was its bundling alongside newer stealer logs, indicating it was being actively used to fuel fresh credential stuffing campaigns.

Why PHPass Password Hashes Still Put Your Accounts at Risk

PHPass was a widely used password hashing library in older versions of WordPress and similar platforms. While it offered some protection compared to plaintext storage, it is not considered strong enough to withstand modern cracking techniques. Attackers with access to these hashes can use brute force tools and precomputed tables to recover a large share of common passwords. Once cracked, those credentials are tested across email providers, social media platforms, and financial services through automated credential stuffing. Even an account on a niche literary fan site can become an entry point to far more sensitive platforms if the same password was reused elsewere.

What Was Exposed in the Niccolo Ammaniti Breach

• Email Address
• Password Hash

Why Old Fan Site Breaches Still Matter Today

This breach is a clear example of the long tail of data exposure. A small Italian literary platform from 2018 may not seem like a major security concern, but the email addresses and passwords it held belong to real people who likely registered using the same credentials they use elsewhere. When that data resurfaces in an active credential stuffing list years later, every account where those credentials were reused becomes a fresh target. Account takeover, identity theft, and financial fraud are all realistic outcomes when older breach data is combined with current attack infrastructure and newer tools.

How a Database Breach Works

A database breach happens when an unauthorized party gains access to the back-end storage of a website, typically through a software vulnerability, SQL injection, or compromised administrator credentials. Fan sites and small literary portals often run on shared hosting with older software versions, making them easier targets than large enterprise platforms. Once inside, an attacker can export the entire user table, capturing every email address and stored password. In the case of the Niccolo Ammaniti site, passwords were stored using PHPass, which looks secure on the surface but can be reversed with modern cracking hardware in a matter of hours for commonly used passwords.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records, including the Niccolo Ammaniti breach and thousands of other leaks from fan sites, portals, ecommerce platforms, and financial services. If your email appeared in this breach, change that password on every service where you used it and turn on two-factor authentication right away. Run your search at HEROIC now to see the full list of breaches tied to your email address.