Dark Web Chatter Confirms the NotchBot (Notchnco) Breach: 28 Accounts Exposed

HEROIC tracked 28 records tied to NotchBot (Notchnco) surfacing on April 12, 2025, after spotting credential stuffing chatter on dark web forums pointed at the US chatbot customization platform. The leak exposed email addresses, phone numbers, usernames, and bcrypt password hashes.

Why This NotchBot (Notchnco) Database Leak Is Dangerous

Our analysts pulled this one from dark web intelligence, not a public paste site. That matters. Records traded in invite-only forums are usually moving toward targeted operations, not random credential stuffing. The small record count and the inclusion of phone numbers and usernames make this dataset more useful for account takeover against a narrow set of customers than for mass fraud campaigns.

What Was Exposed in the NotchBot (Notchnco) Breach

• 28 unique email addresses tied to NotchBot accounts
• Phone numbers for SMS-based authentication bypass attempts
• Usernames used inside the customization platform
• bcrypt password hashes, strong but not invulnerable to weak passwords

Why This Matters

bcrypt slows down password cracking, but it does not stop it. Weak or reused passwords still fall to dictionary attacks, and once a hash is cracked the same credential usually unlocks the victim's email and cloud accounts. Phone numbers in the dump also enable SIM swap attempts against SMS-based two-factor authentication, which is still widely used. Add the NotchBot username and attackers can impersonate the user inside connected workflows, driving phishing, account takeover, and fraud.

How This Database Breach Works

A database compromise on a SaaS tool like NotchBot typically starts with an exposed admin panel, leaked API key, or unpatched web vulnerability. Once inside, the attacker exports the user table and moves the records through invite-only dark web forums where buyers with active operations against similar services pay a premium. HEROIC flagged this leak through OSINT monitoring of those channels.

Check If You Are Affected

If you used NotchBot to build or manage a chatbot, rotate the password and audit any connected services. HEROIC's breach intelligence platform indexes more than 400 billion compromised records, and scanning your email confirms whether your credentials are part of this leak or another dark web dataset.