One Hacking Forum Post. 6,748 Plaintext Passwords. The CASTMe Breach.

HEROIC analysts found a dataset posted to a hacking forum tied to CASTMe, a now-defunct New Zealand online talent casting agency. The breach dates back to August 26, 2018, and exposed 6,748 records, each pairing an email address with a plaintext password.

Why This Is Dangerous

Storing passwords in plaintext leaves nothing standing between a leaked database and a working login. Anyone who downloaded this dataset could read each password exactly as it was typed, with no cracking required, then try that same email and password combination anywhere else it might have been used.

What Was Exposed in the CASTMe Breach

• Email addresses
• Plaintext passwords

Why This Matters

Aspiring performers and models who signed up for casting opportunities likely used the same login they rely on for email, banking, or social media. If any of the 6,748 affected users reused their CASTMe password elsewhere, they face a real risk of credential stuffing, account takeover, and financial fraud, even though the platform itself no longer exists.

How a Database and Combolist Breach Like This Works

This incident is classified as a database breach that was later compiled into a combolist, a plain text file of email and password pairs assembled for easy reuse by attackers. Someone gained unauthorized access to CASTMe's user database, extracted the stored credentials, and posted the resulting file on a hacking forum where anyone could download it and try the logins on other services.

Check If You Are Affected

If you ever had a CASTMe account or think your email address could be part of this or another breach, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records. Run a free scan today, and if your information turns up, change that password everywhere you have reused it.