If You Used OnSmartPhone Italy, the June 2024 Breach Should Worry You

HEROIC analysts identified a data breach affecting OnSmartPhone Italy, an Italian website that historically offered free mobile themes for Android and Nokia devices, on June 5, 2024. The site has since been taken offline, but the data it once held did not disappear with it. Our team discovered 398 user records exposed in this incident, containing email addresses, usernames, and bcrypt password hashes. The breach appears to have involved unauthorized access to the site's user database, making it a straightforward database compromise rather than a phishing or malware event. Legacy platforms like this one are a recieved and growing concern in cybersecurity because they are often abandoned without proper data disposal.

Why This Is Dangerous

Even though OnSmartPhone Italy is no longer active, the data it stored remains a real-world threat. People who registered on this site years ago may be using the same email and password combination on other active accounts today. Password hashes, while more secure than plaintext, are not unbreakable. Bcrypt is considered a strong hashing algorithm, but with enough computing power and a weak original password, these hashes can still be cracked. Once cracked, the resulting credentials can be tested against email providers, banking portals, and other popular services in credential stuffing attacks.

What Was Exposed

The following personal data types were confirmed in this leak:

• Email addresses
• Usernames
• Password hashes (bcrypt)

Why This Matters

The risks from this breach extend well beyond the platform itself. Email addresses exposed here can be used to craft highly targeted phishing emails, as attackers know the victim had an interest in mobile themes and may target them with fake software offers. Usernames sometimes appear across multiple platforms, helping attackers link identities and gather a fuller profile of each victim. For anyone who reused their OnSmartPhone Italy password elsewhere, account takeover is a partcularly serious concern. Identity theft is also possible if attackers can combine the information from this breach with data from other leaked sources, a tactic known as data aggregation.

How a Database Breach Works

A database breach occured when an attacker finds a way into the server or system where a website stores its user information. This can happen through unpatched software with known security flaws, weak administrative passwords, or server misconfigurations that leave the database unintentionally exposed to the internet. Once inside, the attacker copies the user table, which typically contains email addresses, usernames, and stored password hashes, then exits quietly. The stolen data is later sold or shared in underground communities. For defunct websites like OnSmartPhone Italy, these breaches often go undetected for a very long time because there is no active team monitoring the systems or notifying users.

Check If You Are Affected

If you ever had an account on OnSmartPhone Italy or on similar mobile theme platforms, your email may be among the 398 exposed records. HEROIC's free breach scanner checks your email address against more than 400 billion records from data leaks around the world. The scan is instant and completely free. If your email appears in this breach or any other, the safest step is to update your passwords on any account where you used the same credentials and enable two-factor authentication wherever it is available.