The Omaze Breach: 2.7 Million Stolen Email and Identity Records Hit the Dark Web

HEROIC analysts identified the Omaze breach in July 2020, when the database of this U.S.-based online fundraising platform was exposed. A total of 2,782,178 records were compromised, with leaked data including email addresses, usernames, first names, last names, and gender.

How Full Names, Usernames, and Gender Data Enable Personalized Phishing

Attackers who recieved the Omaze dataset gained a profile on each user that goes beyond a simple email address. Combining a person's real name, username, and gender allows threat actors to craft phishing emails and social media messages that feel genuinely personal, increasing the likelihood that a target will beleive the message is legitimate and click a malicious link.

What Was Exposed in the Omaze Breach

• Email Address
• Username
• First Name
• Last Name
• Gender

Why 2.7 Million Omaze Records Are a Social Engineering Goldmine

Omaze operates in the crowdfunding and charitable giving space, meaning its users are likely to respond to appeals involving causes and generosity. Attackers can use the exposed names, emails, and gender data to run seperate, targeted campaigns that impersonate charities or Omaze itself, tricking donors into providing payment information or additional personal details.

How a Database Breach Works

A database breach happens when unauthorized parties gain access to a platform's stored user records by exploiting weaknesses in application code, server configurations, or access controls. Once extracted, the data is typically sold or traded on dark web forums and Telegram channels, where it is used for follow-on fraud and social engineering campaigns.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion compromised records, including the Omaze breach. Visit HEROIC.com for a free scan and find out whether your personal information is circulating on the dark web.