Small Business Owners Exposed in the Plan and Play Data Breach

In August 2018, HEROIC analysts traced a leaked dataset back to Plan and Play, a United States local business listing and directory service that lets businesses create listings and request demos. The breach exposed 4,933 user records, including email addresses and SHA-256 password hashes, which surfaced on a hacking forum.

Why the Plan and Play Breach Is Dangerous for Small Businesses

Plan and Play's user base skewed toward small business owners managing their own listings, which means many of the exposed accounts double as a gateway to a business's contact information and online presence. The passwords in this breach were stored as SHA-256 hashes rather than plaintext, so they are not instantly usable. However, a hash can still be cracked offline, especially for weak or common passwords, once an attacker has the time and the right cracking tools.

What Was Exposed

• Email addresses
• SHA-256 password hashes

Why This Matters

Small business owners often reuse the same password across their email, banking, and business listing accounts, since they are managing everything themselves without dedicated IT support. Once an attacker cracks a hashed password from this breach, they can attempt credential stuffing against those other accounts. That kind of access can lead to a hijacked business email, fraudulent charges, or a business listing altered to redirect customers to a scam.

How Hashed Passwords Like These Get Cracked

A password hash is a scrambled, one-way version of a password that is supposed to be difficult to reverse. SHA-256 is a legitimate hashing method, but on its own it is fast to compute, which makes it a poor fit for password storage. Attackers take a hash like this and run it through cracking software that tests millions of common passwords per second, checking each one against the stolen hash until it finds a match. Short or common passwords fall quickly this way, while combined with other breach data, cracked credentials often end up merged into combolists that criminals use to attack other websites.

Check If You Are Affected

If you ever had an account with Plan and Play, or reused that password on another account, it is worth checking your exposure. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this breach and thousands of others, and tells you immediately if your data has been exposed. Run a free scan today and update any accounts still using an old or reused password.