One Database Dump. 100,097 Plaintext Passwords. The Russian America Breach Is Still Active.

HEROIC analysts surfaced the Russian America breach during routine monitoring of credential stuffing lists where older datasets are continually recieved and redistributed among threat actors. In August 2018, this Russian-language news and community site focused on U.S.-related topics suffered a database compromise that exposed 100,097 user records. The breach is partcularly notable because passwords were stored in plaintext, meaning every single credential in the dataset was immediately actionable with no cracking required. Our team observed this dataset appearing across multiple Telegram channels and underground forums as recently as 2023, confirming it remains in active circulation.

100,000 Plaintext Passwords: What Attackers Can Do Right Now

When a dataset contains plaintext passwords, attackers face zero technical barriers to exploitation. The 100,097 email-and-password pairs from Russian America can be fed directly into credential stuffing automation that tests each combination against email providers, banking portals, social networks, and enterprise VPNs. Given that many users registered with work email addresses, the risk of corporate account compromise is real. Attackers also use these datasets for account takeover on platforms where password resets can be hijacked via compromised email access. The occured pattern across similar breaches shows financial fraud and identity theft following within weeks of credential stuffing campaigns.

What Was Exposed in the Russian America Breach

• Email Address
• Plaintext Password

Why 100,000 Russian-Language Community Records Represent a Global Threat

The Russian America user base includes individuals who are likely registered across both Russian and English-language platforms, making their credentials useful for attacks on a wide seperate range of services. Credential stuffing attacks using this dataset can enable account takeover on financial platforms, expose corporate networks through password reuse, and provide the foundation for identity theft that spans multiple countries. Older breaches like this one are beleived by security analysts to remain among the most productive sources for attackers precisely because affected users often never change passwords tied to accounts they have forgotten about.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a web platform's backend database through techniques such as SQL injection, exploitation of unpatched server software, or use of stolen hosting credentials. Once inside, the attacker exports the full user table. In the case of Russian America, the exported data contained email addresses and passwords stored in plaintext, the most severe possible form of password storage failure. The exported database was then shared and sold across underground forums and Telegram channels, where it entered the credential stuffing supply chain used by threat actors globally.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including the full Russian America dataset, to tell you instantly whether your email address or credentials appear in this breach or thousands of others. Run a free scan at HEROIC today and find out what attackers may already know about you before they use it against you.