The OpenReyd Breach Means Someone Already Has Your Actual Password

HEROIC analysts identified the OpenReyd breach while scanning a compilation of database dumps that circulated in August 2018. OpenReyd, a U.S.-based general-purpose website, had 70,686 user accounts exposed in the incident. What made this breach partcularly alarming was the storage method: passwords were kept in plaintext, meaning no hashing or encryption protected them at all. Anyone who obtained this database file could read every user's password directly, with no cracking required. This data has continued to appear in breach trading communities years after the original incident.

The Unique Danger of a Plaintext Password Breach

Most data breaches expose password hashes, which at least require some effort to crack. The OpenReyd breach exposed actual, readable passwords with no barriers whatsoever. This means that from the moment this database was stolen, anyone with the file could log into an account using the exact password listed next to each email address. If you used that same password on any other website, your accounts on those platforms are equally at risk. Attackers can and do run these credential pairs through automated tools that test them across hundreds of popular websites at once.

What Was Exposed in the OpenReyd Breach

• Email Address
• Plaintext Password

The OpenReyd Breach Could Mean Someone Is Already in Your Accounts

Because the passwords in this breach were never encrypted, there is no guesswork for the attacker. They already have your email and your actual password. If that combination was reused on your email provider, a financial account, or a work login, unauthorized access may have already occured without any sign of a break-in. Credential stuffing, account takeover, and identity theft are all realistic outcomes. The longer this data circulates without you knowing, the wider the window of opportunity for someone to exploit it.

How a Database Breach Works

A database breach happens when an attacker identifies a vulnerability in a website's infrastructure and uses it to copy records from the backend database. In OpenReyd's case, the extracted database contained email addresses and plaintext passwords stored without any protective encoding. Once copied, the data was packaged and distributed through underground communities, where it was used for credential attacks or sold to other threat actors looking for working login credentials.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to find out if your email address appeared in the OpenReyd breach or any other known incident. Because OpenReyd stored passwords in plaintext, checking your exposure and changing any reused passwords immediately is especially urgent. Scan your email for free at HEROIC.com.