Inside the Open Exchange Rates Breach: How a Database Hack Exposed 134K Passwords

HEROIC analysts uncovered the Open Exchange Rates database breach, which occured in March 2020, exposing 134,488 records. The compromised data included email addresses, password hashes, first names, last names, and IP addresses belonging to users of this widely-used currency exchange rate API service based in the United States.

What Attackers Can Do With Your Email, Name, and IP Address

With email addresses, full names, and IP addresses in hand, attackers can launch partcularly convincing phishing campaigns that appear legitimate. Bcrypt-hashed passwords, while strong, can still be cracked over time, and credential stuffing against financial platforms and e-commerce services where users recycle passwords remains a serious ongoing threat.

What Was Exposed in the Open Exchange Rates Breach

• Email Address
• Password Hash
• First Name
• Last Name
• IP Address

Why the Open Exchange Rates Breach Still Puts API Users at Risk

Open Exchange Rates serves developers and financial platforms globally. Compromised accounts from this service are seperate from typical consumer breaches because they often belong to engineers and businesses with access to critical financial infrastructure. Exposed credentials can open doors to fraudulent API usage and supply chain attacks on downstream applications.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a stored collection of user data, typically by exploiting a vulnerability in a web application, a misconfigured server, or through stolen administrative credentials. Once inside, attackers extract and often sell the raw data on dark web marketplaces or hacking forums.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across 400 billion-plus records to tell you exactly what information of yours has been exposed. Run a free scan today to find out if your email or credentials appeared in the Open Exchange Rates breach or any other known incident.