Otmouthe Data Breach Exposes 7K French Tourism Platform MD5 and Plaintext Passwords

HEROIC's DarkHive system discovered the Otmouthe breach, exposing 7,116 records in August 2025. This French platform suffered a database and combolist compromise that revealed user email addresses, MD5 password hashes, and plaintext passwords belonging to French internet users registered on this service.

Why This Is Dangerous

Breaches that expose both MD5 hashed and plaintext versions of passwords confirm that the platform stored passwords in multiple insecure formats simultaneously, representing a fundamental failure in security practices that maximizes attacker access to usable credentials. The combination of MD5 hashes and plaintext passwords means attackers have immediate access to working credentials requiring no cracking effort, while also possessing recoverable hashes for any accounts where plaintext was not directly stored. French platform credentials are used in targeted campaigns against French banking, government digital services, and commercial platforms where the same email and password may be active.

What Was Exposed

• Email Address
• Password Hash (MD5)
• Plaintext Password

Why This Matters

Otmouthe users whose plaintext passwords were exposed face immediate account takeover risk across any platform where those same credentials were reused, as attackers can directly authenticate without any additional processing. The dual exposure of both hashed and plaintext credentials suggests exceptionally poor security practices that call into question the overall security posture of the platform across all data handling. Anyone who registered on Otmouthe must immediately change their password on every platform where those credentials were used.

How Database and Combolist Breach Works

Platforms that store passwords in plaintext alongside inadequate MD5 hashes represent the most vulnerable category of web service from a credential security perspective. Attackers that gain access to such databases immediately possess working credentials that require no further processing before deployment in account takeover campaigns. These hybrid credential sets are particularly valuable to criminal actors who trade them on underground forums as high-quality combolist material with confirmed validity rates.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the Otmouthe breach. Visit heroic.com to check if your information was exposed.