OneCredit Breach Exposed 2,328 Records With Names and Birthdays

HEROIC analysts identified a database breach tied to OneCredit, a now-defunct Indian IT services platform, with the data posted to a Telegram channel on January 12, 2025. The breach exposed 2,328 records, including email addresses, phone numbers, first and last names, and birthdays.

Why This Is Dangerous

This leak doesn't include passwords, so it can't be used to log directly into anything. But the combination of a full name, phone number, email address, and birthday is exactly the kind of information used to pass identity verification checks at banks, phone carriers, and other services. It's also enough detail for a scammer to craft a convincing, personalized message that sounds like it comes from someone who already knows you.

What Was Exposed

• Email addresses of OneCredit users
• Phone numbers on file with the platform
• First and last names
• Birthdays

Why This Matters

Even without a stolen password, this kind of data feeds directly into identity theft. A birthday combined with a full name and phone number is often enough to answer security questions or pass identity checks that many companies still rely on. Fraudsters also use this level of detail for targeted phishing and vishing calls, and for SIM-swapping attempts aimed at hijacking a victim's phone number to intercept verification codes for other accounts.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to a company's stored customer records, often through an exploited vulnerability, a misconfigured server, or stolen administrative credentials, and extracts the data in bulk. Even after OneCredit ceased operations, its stored user data apparently remained accessible or recoverable, ending up in an attacker's hands and then posted to a Telegram channel, a common distribution point that puts leaked records within easy reach of any criminal browsing for fresh targets.

Check If You Are Affected

You can check whether your information appears in this breach or any other using HEROIC's free breach scanner, which searches a database of more than 400 billion leaked and breached records. If you're affected, stay alert for phishing calls, texts, or emails that reference your real name or birthday, and avoid using easily guessed security question answers based on that information.