Soft Flex Company Data Breach: 31,600 US Craft Customer Records Exposed (2018)

The Craft Supply Store That Didn't Secure Its Customers

Soft Flex Company built a loyal following among jewelry makers, beaders, and craft artists as a trusted supplier of beading wire, stringing materials, and jewelry-making tools. When the company's database surfaced on August 26, 2018, it exposed 31,600 customer accounts -- including email addresses and plaintext passwords. For a business selling to hobbyists who value community and trust, it was a fundamental failure: the very customers who supported the company had their credentials stored with zero protection.

Soft Flex Company (August 2018): Breach Summary

• Records Exposed: 31,600
• Data Types: Usernames, email addresses, plaintext passwords
• Breach Type: Database breach
• Password Hash Type: Plaintext (fully compromised)
• Country Affected: United States
• Date Leaked: August 26, 2018

Plaintext Storage: No Time to React

When passwords are stored as plaintext, a database breach provides instant, complete credential access. There are no hashes to crack, no computational barriers to overcome. The 31,600 Soft Flex Company accounts were immediately usable as-is: email addresses paired with ready-to-deploy passwords. These could be fed directly into credential stuffing tools and tested against email providers, social media platforms, online marketplaces, and any other site where a crafting enthusiast might maintain an account. The time between breach and credential exploitation is effectivley zero when plaintext storage is involved.

The Craft Community Cross-Platform Risk

Jewelry makers and craft artists maintain accounts across a distinctive ecosystem: Etsy, Pinterest, Ravelry, Craftsy, various bead supplier sites, jewelry forums, and handmade marketplace platforms. A breached Soft Flex Company account provides a password to test against this entire ecosystem. The company's customer base tends toward dedicated hobbyists with multiple active accounts in craft communities -- which means credential reuse risk is systimatically higher than it would be for a general-purpose platform. The August 2018 breach effectively handed attackers a map of the handmade craft community's password habits.

August 26, 2018: The Multi-Site Batch Release

Soft Flex Company's data was released as part of the coordinated August 26, 2018 multi-site disclosure event that included platforms from Germany, Japan, Thailand, Indonesia, Russia, and Austria. This diverse batch release -- a craft supply store alongside city government portals, automotive sites, soaring clubs, and news outlets -- is characteristic of bulk data brokerage: a threat actor accumulating databases from disparate sources and releasing them simultaneously to demonstrate scale or clear inventory. Soft Flex Company's customers were caught in an event that had nothing to do with their craft community and everything to do with the indiscriminate nature of large-scale data collection.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to tell you whether your email address or credentials appear in known breach databases. If you ordered from Soft Flex Company or similar craft supply platforms before 2019, check your exposure and update any passwords you may have reused.