Redbox Data Breach: 211,372 Customer Accounts Exposed in 2008

HEROIC's DarkHive intelligence system detected the Redbox data breach, exposing 211,372 records from the popular DVD and Blu-ray rental kiosk service. The breach occured around January 2008 when the Redbox user database was compromised and account credentials were extracted in plaintext. Redbox operated thousands of rental kiosks across the United States, and the affected accounts belonged to customers who registered online to manage thier rentals and account preferences.

Why This Is Dangerous

Plaintext passwords in this breach require no cracking tools to exploit. Every exposed password is immediately readable and usable by anyone who obtains the dataset. Redbox customers from 2008 who reused their account password on email services, streaming platforms, or other websites face direct account compromise risk. The scale of over 211,000 records makes this a substantial source of ready-to-use credentials for automated stuffing attacks. Combined with customer email addresses, these credentials allow attackers to systematically test access across hundreds of other services in minutes.

What Was Exposed

• User Account Credentials (plaintext passwords)
• Customer Account Information

Why This Matters

Redbox customers in 2008 were a mainstream US consumer audience, including millions of users who may have been using the same password across thier email accounts, bank websites, and early streaming services. Unlike breaches from specialized or niche platforms, a consumer entertainment service like Redbox attracts users who are generally less security-conscious and more likely to reuse simple passwords across many accounts. Over 211,000 plaintext records from a recognizable consumer brand provide attackers with a credential list that remains active as long as users have not changed thier passwords on the other services where they reused those credentials.

How Database Breaches Work

Consumer-facing platforms that stored plaintext passwords were operating below the security standards that experts had been recommending since the late 1990s. When attackers exploit SQL injection vulnerabilities or gain unauthorized access to a database storing plaintext credentials, every account in that database becomes immediately compromised without any additional processing. The attacker simply reads the email and password fields directly and loads them into credential stuffing tools. In 2008, many web platforms had not yet adopted password hashing as a standard practice, leaving thier users completely exposed if a database breach occured.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Redbox. Visit heroic.com to scan your email address and find out if your account was part of this breach. If you had a Redbox account around 2008 and recieve a positive result, change any other accounts where you may have used the same password immediatley, paying particular attention to your primary email account, since email access is the master key attackers use to take over all your other accounts through password reset functions.