Digital Publishers Targeted in the PubPit Leak of 51,146 Passwords

HEROIC analysts have added the PubPit data breach to our records. PubPit, a US-based software-as-a-service platform behind the Turn-Page digital publishing tool at pubpit.com, was breached on July 13, 2020, exposing 51,146 unique records. The compromised data includes email addresses and plaintext passwords, which were later posted on a popular hacking forum.

Why This Is Dangerous

Anyone who used PubPit's Turn-Page platform to publish digital content had their login credentials stored, and exposed, in plaintext. That means an attacker does not need to crack anything to use them. They can take an email and password pair straight from this leak and attempt to log directly into a PubPit account, and from there, into any other account that shares the same password.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Publishers, authors, and small businesses that relied on PubPit to distribute digital content are the ones directly targeted by this leak. Credential pairs like these are used in credential stuffing attacks, where attackers automatically test the same email and password combination against banking sites, email providers, and social media accounts. If a PubPit user reused their password anywhere else, this leak can lead straight to account takeover, identity theft, or financial fraud well beyond the original platform.

How This Combolist Was Created

PubPit's breach is classified as a database and combolist incident, meaning attackers accessed the platform's own user database and later compiled the stolen data into a combolist, a simple file that pairs each email address with its matching password. Combolists like this one are traded and reposted on hacking forums, where they remain usable for years after the original breach, especially against users who never changed their password.

Check If You Are Affected

If you ever created a PubPit account, your email and password may still be circulating on hacking forums today. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including the PubPit breach, so you can find out quickly whether your information was exposed.