The Shoptime Breach: Just 80 Accounts, but Real Passwords Exposed

HEROIC analysts identified a database breach tied to Shoptime, a Brazilian e-commerce platform. The breach is dated September 25, 2015, and while the total footprint is small at just 80 accounts, it exposed a direct pairing of email addresses and plaintext passwords for the people affected.

Why This Is Dangerous

A small breach is not a safe breach. For each of the 80 people in this leak, an email address and a plaintext password sit together in a single record, with no hashing or encryption standing between an attacker and their login. That is enough for someone to log directly into the affected account, or to try that same password on other sites the person uses.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Because the passwords in this leak were stored in plaintext, there is no cracking or guesswork required, an attacker simply reads them. If any of the 80 affected accounts reused that password on an email provider, a bank, or a social media account, the same credentials will often work there too. This is the basis of credential stuffing: attackers take known email and password pairs and test them automatically across hundreds of other websites, looking for one that grants access.

How Database Breaches Like This Happen

This incident is classified as a database breach, meaning attackers gained direct access to Shoptime's backend systems rather than tricking individual users. Storing passwords in plaintext, without hashing them first, is one of the clearest security failures a website can make: if the database is ever accessed, every password is instantly usable. Smaller platforms like Shoptime often lack the dedicated security teams that larger retailers have, which can leave gaps like this in place for years before they are discovered.

Check If You Are Affected

Even a small breach like this one is worth checking, especially since the passwords involved were never protected in the first place. HEROIC's free breach scanner searches a database of more than 400 billion breached records to tell you instantly whether your email address has been exposed, and where. It takes seconds to check.