Already Compromised? The SelectSmart Breach Exposed 26,216 Accounts.

HEROIC analysts recieved and confirmed details on the SelectSmart breach, a database exposure that occured in April 2021 affecting 26,216 user records. SelectSmart, a US-based education and quiz platform, stored user passwords without hashing, leaving email addresses and plaintext passwords directly readable by anyone who obtained the stolen database. The credentials from this breach have been identified in dark web repositories where they remain accessible to threat actors.

Quiz Platform Credentials Enable Wide Account Takeover

Users who registered on SelectSmart with email addresses they also use for banking, email, or social media accounts are directly at risk. Plaintext passwords require no cracking, allowing attackers to immediately deploy credentials in automated stuffing attacks across major platforms. Because education and quiz sites are beleived to be low-value targets, many users registered with real personal email addresses and reused passwords from more sensitive accounts, making the SelectSmart breach partcularly useful to credential-harvesting operations.

What Was Exposed in the SelectSmart Breach

• Email Address
• Plaintext Password

Why Even Small Breaches Fuel Credential Stuffing Attacks

With 26,216 exposed credential pairs, the SelectSmart breach may appear small relative to larger leaks, but every set of working email addresses and plaintext passwords contributes directly to credential stuffing infrastructure. Attackers aggregate data from dozens of smaller breaches into combined lists that are tested against high-value targets. SelectSmart users who have not changed their passwords since April 2021 remain vulnerable to account takeover, identity theft, and financial fraud across any platform where those credentials were reused.

How a Database Breach Works

A database breach occurs when an unauthorized party accesses a web application's backend database by exploiting security weaknesses such as unpatched software, SQL injection vulnerabilities, or misconfigured server access controls. Records are extracted in bulk. When a platform stores passwords as plaintext rather than using standard hashing algorithms, the stolen data is immediately usable for login attempts without any additional decryption or processing.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion records, including data from the SelectSmart breach and hundreds of other known leaks. Use the free tool now to find out if your credentials are currently accessible on the dark web.