Your Data May Be Exposed Again: ShoppingBitcoins Leaked 294 Records

HEROIC analysts identified a separate data breach record tied to ShoppingBitcoins, a US-based cryptocurrency shopping platform, also dated September 28, 2015. This record covers a distinct set of 294 exposed entries, each containing an email address and a password stored in plaintext. This is a smaller, separately tracked batch of records from the same site as another ShoppingBitcoins exposure HEROIC has documented, and the two should not be treated as the same 2,521-record incident.

Why This Second ShoppingBitcoins Record Still Poses a Real Risk

Whether a person's data appears in a batch of 294 records or a batch of thousands, the risk to that individual is identical. Because these passwords were stored in plaintext rather than hashed, anyone who has this data can read each password exactly as it was created, with no cracking required. On a site tied to cryptocurrency purchases, that is particularly concerning, since crypto-related accounts are frequently reused with wallets, exchanges, or other financial logins.

What Was Exposed

• Email addresses
• Passwords, stored and exposed in plaintext

Why This Matters

A working, uncracked password paired with an email address is one of the most immediately dangerous combinations a breach can expose. If any of these 294 people reused this password on a wallet, exchange, or bank account, an attacker can attempt to log in directly, no cracking tools needed. This is the foundation of credential stuffing, where leaked email and password pairs are tested automatically against other services, leading to account takeover, identity theft, and financial fraud.

How This Database Breach Happened

This incident is classified as a database breach, meaning the records were extracted directly from ShoppingBitcoins' stored user data. Storing passwords in plaintext is a fundamental security failure, since it means a single instance of unauthorized database access exposes every password in the batch immediately, without requiring any additional effort from an attacker.

Check If You Are Affected

If you ever had an account on ShoppingBitcoins, it is worth checking whether your email and password appear in this or the related exposure from the same site. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, giving you an instant answer so you can update any reused passwords before someone else uses them.