Change Your OroPocket Password Now: 27K Records Leaked

HEROIC analysts verified the OroPocket database leak on February 5, 2025, after the New Delhi fintech's user table (oropocket.com) appeared on a dark web marketplace. The dump exposed 27,189 user records with email addresses, phone numbers, first and last names, IP addresses, birthdays, and MD5 password hashes.

Why This Fintech Breach Is Dangerous

MD5 is a broken password hash. Free tools crack common MD5 passwords in seconds using rainbow tables, so the OroPocket hashes should be treated as plaintext in practice. Pair that with the accompanying PII and the breach becomes an identity kit for fraud targeting an Indian fintech customer base.

What Was Exposed in the OroPocket Leak

• Email addresses registered to OroPocket accounts
• Phone numbers linked to user profiles
• First names and last names
• IP addresses captured at registration or login
• Birthdays used for identity verification
• MD5 password hashes (trivially crackable)

Why This Matters

Cracked MD5 hashes feed straight into credential stuffing against banks, crypto exchanges, and payment apps. The phone and birthday combination unlocks SIM swap attempts and identity theft. For a fintech that handles gold-backed digital assets, compromised accounts translate to direct financial loss.

How Database Breaches Work

A database breach typically starts with SQL injection, an unsecured admin endpoint, or a compromised developer credential. Attackers export the users table, crack weak hashes offline, and publish or sell the combined PII and credentials. Outdated hashing schemes like MD5 transform a partial breach into a full credential compromise.

Check If You Are Affected

If you registered with OroPocket or reused that password on another service, rotate it immediately and enable multi-factor authentication. Run HEROIC's free scan against more than 400 billion exposed records to confirm whether your email, phone, or password hash appears in this dump.