PHPass Hashes, 35,474 Records: The BPOTech Data Breach

HEROIC analysts identified a database breach affecting BPOTech, a Vietnamese IT services organization, on August 19, 2024. The incident exposed 35,474 records containing email addresses, usernames, and PHPass-hashed passwords. PHPass is a password hashing framework that, while better than storing credentials in plain text, is considered weak by current standards and is vulnerable to brute-force and rainbow table attacks, particularly when user passwords are short or common.

Why This Is Dangerous

With access to email addresses, usernames, and PHPass password hashes, attackers can attempt to crack the hashed passwords offline using specialized hardware and wordlist attacks. Once cracked, those credentials can be tested across banking platforms, email providers, and other services where affected users may have reused the same login details. Even if passwords resist cracking, the combination of email and username data is sufficient to launch highly targeted phishing campaigns against BPOTech's customer and employee base.

What Was Exposed

• Email Address
• Username
• Password Hash (PHPass format)

Why This Matters

Credential-based attacks remain one of the most common entry points for account takeover and identity fraud. When email addresses and hashed passwords are sold on underground forums, threat actors use automated tools to test billions of username and password combinations across popular platforms at scale. For affected BPOTech users, there is a real risk of unauthorized access to accounts where they reused their credentials, potential identity theft, and exposure to targeted phishing using their confirmed email addresses.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to a company's backend data store. Common methods include exploiting unpatched software vulnerabilities, SQL injection attacks against web-facing applications, stolen administrative credentials, and misconfigured cloud storage. Once inside, attackers can copy or download entire tables of user records within minutes. The exfiltrated data is then packaged and sold or distributed on dark web marketplaces, often surfacing weeks or months after the initial compromise.

Check If You Are Affected

If you have ever created an account with BPOTech or used the bpotech.com.vn platform, your credentials may be part of this breach. Use the HEROIC free breach scanner to check your email against our database of 400 billion or more compromised records and find out whether your information has been exposed.