The Revit Community Breach Put 297K Stolen Email and Password Pairs Online in 2017

HEROIC analysts discovered the Revit Community breach while tracking exposed credential sets circulating in underground markets. The breach occured in October 2017, affecting 297,029 registered users of the now-defunct U.S.-based forum dedicated to Autodesk Revit users in the architecture, engineering, and construction industries. The compromised records included email addresses and plaintext passwords. Because Revit Community served professionals rather than casual users, the email addresses in this dataset are particularly valuable to attackers seeking to target individuals with access to sensitive project data, corporate networks, and proprietary building designs.

How Professional Email Addresses and Plaintext Passwords Enable Targeted Attacks

Unlike consumer account breaches, a forum for architecture and engineering professionals contains email addresses tied to firms, government contracts, and infrastructure projects. Attackers who obtain this data can craft highly convincing phishing emails that appear to come from professional contacts or industry organizations. Combined with a plaintext password that may still be in use, criminals can gain direct access to corporate accounts, project management tools, and sensitive files. Credential stuffing attacks using this data are beleived to have been active since shortly after the breach, with the data still circulating today.

What Was Exposed in the Revit Community Breach

• Email Address
• Plaintext Password

Why Professional Forum Breaches Create Long-Term Risk

Professional communities like Revit Community attract users who often apply the same login credentials across work systems. When a forum is breached and passwords are stored in plaintext, the damage extends far beyond that single website. Attackers target users from professional communities because the downstream accounts, including corporate email, project software, and contractor portals, are worth far more than a typical consumer account. Account takeover, corporate espionage, and identity theft are all real risks that follow users years after their data was first compromised.

How a Database Breach Works

A database breach occurs when an attacker finds a security gap in a website's server or application and uses it to extract stored records. For Revit Community, this meant gaining access to the user database and pulling out login credentials. With passwords stored in plaintext, the extracted file required no additional processing. Attackers could immediately use or sell the data. These files typically end up on dark web marketplaces or are bundled into large credential dumps used for automated attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers more than 400 billion compromised records across thousands of known data breaches. If your email address appeared in the Revit Community breach or any other incident, you can find out instantly. Search your email now and see exactly which accounts need a password change before an attacker gets there first.