The Sito del Ciclismo Leak: 12,375 Plaintext Passwords Exposed. Yours Might Be One.

In August 2018, Sito del Ciclismo, an Italian web resource and archive dedicated to professional cycling, suffered a data breach that exposed 12,375 user accounts. The compromised data included email addresses and passwords stored in plaintext. Not hashed. Not encrypted. Readable as-is by anyone who downloaded the file. The dataset surfaced on underground sources and has since been incorporated into combolists used in automated account takeover attacks. If you ever registered on this site, your password was handed directly to attackers.

Why This Is Dangerous

Most breaches require some effort from attackers after the fact: they obtain password hashes and then spend time cracking them. This breach skips that step entirely. Plaintext storage means every password in the Sito del Ciclismo database was immediately readable the moment the breach occurred. There is no cracking phase, no waiting, no uncertainty. Attackers loaded the file and started testing credentials against Gmail, Outlook, banking apps, and corporate VPNs within hours. If you used the same password on this cycling site as on any other service, that account is at risk right now, regardless of how long ago you signed up.

What Was Exposed

• Records affected: 12,375 unique user accounts
• Email addresses: Full addresses belonging to Italian cycling enthusiasts and sports fans
• Plaintext passwords: Completely unprotected, directly readable with no decryption needed
• Platform type: Italian cycling archive covering racers, teams, and competiton results
• Country of origin: Italy
• Breach date: August 26, 2018
• Distribution: Underground sources; incorporated into combolists targeting Italian internet users

Why This Matters

Plaintext password storage is not a mistake made by careful engineers who chose the wrong algorithm. It is a sign that security was never considered at all during the site's development. For the 12,375 users who registered on Sito del Ciclismo, the breach effectively handed their passwords to any threat actor willing to download a forum post. Years later, that data continues to circulate and be tested against active accounts. The passwords in this dataset are still being used in automated attacks today because credential stuffing tools do not expire old datasets unless the target accounts are closed or the passwords are changed.

How Plaintext Password Breaches Work

When a site stores passwords in plaintext, the attack timeline collapses. In a normal breach involving hashed passwords, attackers must spend time and computing power cracking the hashes before the credentials become useable. With plaintext storage, that entire phase is eliminated. An attacker who gains database access via SQL injection, a compromised admin account, or a backup file left exposed on a public server immediately has working credentials for every registered user. Those credentials are then exported, deduped, and loaded into tools like Sentry MBA or OpenBullet, which test thousands of login attempts per minute across popular websites. The Sito del Ciclismo datset required zero post-breach processing before it was weaponized.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against more than 400 billion compromised records, including this Sito del Ciclismo dataset and thousands of similar breaches where passwords were stored without any protection. If your email appears in any known leak, you will receive an immediate alert. Do not wait. Run your free scan now.