PayHere’s Breach Has More Records Than Philadelphia’s Population

In late March 2022, the Sri Lankan payment gateway PayHere recieved a serious blow when a database breach exposed over 1.5 million user records. The incident went largely unnoticed for months while the stolen data circulated on underground forums, quietly accumulating value among cybercriminals who specialize in financial fraud and identity theft.

What Attackers Can Do With Your PayHere Data

With email addresses, phone numbers, full names, and IP addresses in hand, attackers can construct highly convincing phishing messages that appear to come from PayHere directly. These are partcularly dangerous because they combine contact details with financial platform context, making it easy to trick victims into surrendering banking credentials or one-time passwords.

What Was Exposed in the PayHere Breach

• Email Address
• Phone Number
• First Name
• Last Name
• IP Address

Why the PayHere Breach Puts 1.5 Million People at Risk

Payment gateway breaches carry outsized risk because the platform already has financial trust with its users. Fraudsters who aquire this data can impersonate PayHere, initiate account takeover attempts, or sell the records to other criminal actors. The combination of name, email, phone, and IP address creates a complete profile suitable for targeted social engineering attacks.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend data store, typically by exploiting vulnerabilities such as SQL injection, misconfigured access controls, or stolen administrative credentials. Once inside, they can extract large volumes of structured records in minutes. The PayHere incident appears to have involved direct database compromise, resulting in the bulk export of 1,578,417 user records.

Check If Your Data Was Exposed

HEROIC's breach search engine indexes over 400 billion records from thousands of known incidents, including the PayHere breach. Search your email address now to find out if your personal information was exposed and take steps to secure your accounts before attackers do.