Researchers Link the Quidd Breach to 3.5 Million Stolen Accounts

HEROIC analysts identified the Quidd breach as part of an investigation into credential sets tied to digital collectibles and entertainment platforms. The breach occured on July 31, 2016, and exposed 3,574,337 user records from quidd.co, a United States-based app that allowed users to collect and trade digital stickers, cards, and licensed pop-culture items. The leaked dataset contained email addresses, usernames, and bcrypt password hashes, all of which have since been indexed across multiple breach aggregation services and dark web marketplaces.

How bcrypt Hashes From the Quidd Breach Can Still Endanger Users

Although bcrypt is a stronger hashing method than MD5, it is not immune to cracking when users chose weak or commonly reused passwords. Attackers with access to the Quidd dataset can run targeted dictionary attacks against the hashes, recovering credentials that are then tested across email, social media, and financial platforms. The combination of username and email address data is partcularly useful because it helps attackers confirm account ownership before launching automated login attempts elsewhere.

What Was Exposed in the Quidd Breach

• Email Address
• Username
• Password Hash

Why Entertainment Platform Breaches Create Long-Term Identity Risk

Apps like Quidd attracted younger audiences who may have recieved no formal notification that their data was ever compromised. Many of those users likely reused the same email and password combination across other platforms, including accounts they still access today. When those credentials end up in combo lists circulated by attackers, the result is large-scale credential stuffing, account takeover, and in cases where payment details were linked, seperate incidents of financial fraud.

How Database Breaches Work

A database breach happens when an attacker exploits a vulnerability, misconfiguration, or weak credential to gain access to the server where user data is stored. Once inside, they copy the user records table and export it. For app platforms like Quidd, this data is often a complete snapshot of every registered account, including login credentials and any profile information users provided at signup. The platform may not detect the extraction for days, weeks, or longer.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records including the Quidd dataset. Enter your email address at HEROIC.com to instantly check whether your credentials are circulating on the dark web and get clear guidance on what steps to take next.