PolymerTrack Security Breach Exposes User Plaintext Passwords

HEROIC's DarkHive intelligence system discovered the PolymerTrack data breach, exposing 22,807 records. The breach occured in August 2018, targeting users of this UK-based industrial commodity pricing portal for the plastics and polymer industry. The compromised data includes email addresses and plaintext passwords, which represents one of the most dangerous forms of credential exposure possible.

Why This Is Dangerous

Plaintext passwords require zero effort to use. Attackers who obtain this dataset can immediately attempt to log into email accounts, banking platforms, and business systems using the exact credentials without any cracking step. PolymerTrack serves businesses in plastics production, supply chain management, and procurement, meaning many affected users manage sensitive commercial and financial accounts. Criminals who gain access to a procurement manager's email can intercept purchase orders, redirect payments, and impersonate the victim in business communications.

What Was Exposed

• Email Address
• Plaintext Password

Why This Matters

Industrial and supply chain platforms serve businesses that handle significant financial transactions and proprietary market data. A compromised account on a platform like PolymerTrack could reveal pricing strategies, supplier relationships, and procurement budgets to competitors or criminals. Beyond business espionage, attackers use plaintext credentials in large-scale credential stuffing attacks, testing each email and password pair against dozens of popular services. Users who recieve communications through a compromised email account may also become victims of follow-on fraud and social engineering attacks targeting thier colleagues and business partners.

How Database Breaches Work

Database breaches occur when attackers exploit security weaknesses in a website or web application to gain unauthorized access to the database storing user accounts. Common vulnerabilities include unpatched software, SQL injection flaws, and exposed administrative interfaces. Storing passwords in plaintext, as PolymerTrack did, is a severe security failure because it means any database access immediately yields usable credentials. The stolen data is then distributed through criminal networks, sold on dark web markets, and incorporated into large credential lists used for automated attacks against other online services.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like PolymerTrack. Visit heroic.com to scan your email address and find out if your information was exposed.