No Encryption. No Warning. The Personality Code (TalentSmart) Had 24,554 Records.

HEROIC analysts flagged the Personality Code breach while scanning a Telegram channel known for aggregating older database dumps. What made this one partcularly alarming was not the size of the dataset, at just under 25,000 records, but what was inside. The breach, which occured in August 2018, exposed email addresses alongside passwords stored in plain text with no hashing or encryption at all. TalentSmart's Personality Code platform, an online emotional intelligence assessment tool, had stored user credentials in the most vulnerable format possible.

Plaintext Passwords Are the Worst-Case Scenario for Breach Victims

When passwords are stored as plain text, there is nothing to crack. Any attacker who gets the database can read every password instantly, then try those exact credentials on email accounts, banking sites, social media, and workplace tools. Unlike hashed passwords which at least require some effort to exploit, plain text passwords from The Personality Code (TalentSmart) gave attackers immediate, ready-to-use login credentials for 24,554 accounts.

What Was Exposed in the The Personality Code (TalentSmart) Breach

• Email Address
• Plaintext Password

Why a Personality Assessment Platform Is a Surprising but Serious Risk

Business and HR platforms attract professional users who often rely on work email addresses and beleive the site is too niche to be targeted. But attackers do not discriminate by industry. When those same work credentials appear in a breach, they become a direct path into corporate accounts, internal tools, and systems far more sensitive than any personality quiz. This breach is a reminder that account takeover, credential stuffing, and identity theft can originate from the least expected sources.

How a Database Breach Works

A database breach occurs when an attacker finds a vulnerability in a website or application and uses it to download the underlying data store. For sites storing plaintext passwords, this is especially damaging because no additional cracking step is needed. The attacker simply exports the data and has a list of working email and password pairs ready for use or sale on dark web forums.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against over 400 billion compromised records, including those from The Personality Code (TalentSmart) breach. Run a free scan now to find out if your credentials are already in attackers' hands.