Identity Theft Got Easier Because of the Orbit Investments Breach: 903 Records at Risk

HEROIC analysts discovered the Orbit Investments breach, which occured in January 2021, exposing 903 records from a U.S.-based property management firm. The compromised database contained email addresses, phone numbers, MD5 password hashes, first names, last names, and birthdays, recieved from a private database dump circulating in underground channels.

Crackable MD5 Hashes Combined With Birthdays Enable Account Takeover

MD5 is a long-obsolete hashing algorithm that attackers can reverse using readily accessable rainbow tables and brute-force tools. Combined with full names, birthdays, phone numbers, and email addresses, cracked passwords give attackers everything needed to impersonate victims, reset account credentials on other platforms, and commit financial fraud.

What Was Exposed in the Orbit Investments Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name
• Birthday

Why Financial and Real Estate PII Is Particularly Dangerous

Investment and property management companies hold personal data that overlaps directly with identity verification systems. When email, birthday, name, and phone number leak together, attackers can bypass knowledge-based authentication on banking and financial platforms, enabling credential stuffing, account takeover, and identity theft against people who may have no idea their data was ever exposed.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a stored dataset, often by exploiting unpatched software vulnerabilities or weak credentials. Once access is established, records are extracted in bulk. In cases like Orbit Investments, the resulting dump is then traded or sold in private channels, where buyers use the data for credential attacks and identity fraud.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against over 400 billion records, including the Orbit Investments breach. Visit HEROIC.com to instantly see whether your personal data is already circulating in known breach databases.