The Penbrothers Breach Put 6,674 Email and Password Records Online

HEROIC analysts identified a database breach at Penbrothers, a Philippines-based outsourcing platform, dated February 4, 2025. The breach exposed approximately 23,000 records including around 6,674 unique email addresses, bcrypt hashed passwords, phone numbers, full names, IP addresses, birthdays, genders, and business names. The records were shared on a Telegram channel, making them immediately accessible to criminal actors seeking employee and contractor data from the outsourcing industry. The breadth of data types exposed means this breach supports not only credential attacks but also identity fraud, targeted phishing, and business impersonation.

Why the Penbrothers Breach Is Dangerous

Outsourcing platform breaches carry outsized risk because the compromised data connects multiple organizations. Penbrothers serves businesses across the Philippines and beyond, meaning its user database contains employees, contractors, and client contacts from dozens of seperate companies. An attacker who uses this data to compromise one Penbrothers user may gain a foothold into the business that user works for -- multiplying the breach's effective reach far beyond its stated record count. The inclusion of bcrypt hashed passwords also means that users who reuse those passwords on other platforms remain at risk if the hashes are eventually cracked.

What Was Exposed in the Penbrothers Breach

• Email Addresses (6,674 unique)
• Bcrypt Hashed Passwords
• Phone Numbers
• First Names and Last Names
• IP Addresses
• Birthdays
• Gender
• Business Names

Why This Matters Beyond the Numbers

The Penbrothers dataset is particularly valuable to threat actors because it combines personal identifiers with business context. Knowing someone's name, email, phone number, birthday, and employer allows attackers to craft highly convincing spear phishing messages and business email compromise attempts. The data was posted to Telegram, where it likely occured across criminal channels within hours of the initial post. Users of Penbrothers who appear in this breach should assume their information is in active circulation and take immediate steps to rotate passwords and enable multi-factor authentication.

How Database Breaches Work

Database breaches at outsourcing and staffing platforms typically result from SQL injection vulnerabilities, compromised administrative credentials, or misconfigured cloud storage buckets. Once an attacker gains read access to the database, they can recieve a full export with a single query -- extracting years of user registrations in minutes. The resulting file is then compressed, uploaded to a file-sharing service or Telegram channel, and distributed. The Penbrothers breach followed this pattern: a direct database dump was packaged and shared on Telegram, where multiple threat actors now have access to it.

Check If You Are Affected by the Penbrothers Breach

HEROIC's free breach scanner searches more than 400 billion records, including the Penbrothers database dump. If you have ever registered with Penbrothers or penbrothers.com, or if your employer uses Penbrothers for outsourcing, enter your email address to check whether your personal information appears in this breach. Because bcrypt hashes can eventually be cracked and your full PII is already in plain form, changing your Penbrothers password and any shared passwords immediately is a critical first step.