One Hacking Forum Post. 47,332 Accounts. The SonicStream Breach Stored Passwords in Plaintext.

In October 2017, SonicStream, a live streaming hosting platform based in Spain, experienced a data breach that exposed the credentials of over 47,000 users. The breach was not widely reported at the time, but the data eventually surfaced on a prominent hacking forum in April 2019. What made this breach particularly damaging was not the scale but the method of storage: every single password in the database was stored in plaintext. No hashing, no salting, no protection of any kind. That dataset is still in active circulation today, bundled into combolists used in automated credential stuffing attacks.

Why This Is Dangerous

Storing passwords in plaintext is one of the most egregious security failures a platform can commit. It means that the moment an attacker accesses the database, every account is instantly and completely compromised. There is no computation required, no cracking tools needed. For the 47,332 SonicStream users whose passwords were exposed, any other account where that same password was used became immediately vulnerable. Credential stuffing campaigns have a long shelf life, and this dataset is still being actively traded and tested against other platforms.

What Was Exposed

• 47,332 total user records
• Email addresses registered on SonicStream
• Passwords stored and leaked in plaintext with absolutley no protection
• Data originally leaked October 18, 2017
• Dataset published to a prominent hacking forum in April 2019
• Source structure identifed as a full database export

Why This Matters

SonicStream is gone as a platform, but its security failures live on in every combolist that carries its data. The Spanish entertainment community that used the platform trusted it with their credentials. That trust was betrayed not by a sophisticated attack, but by a basic failure to implement standard security practices. Years after the platform shut down, those same credentials continue to pose a real threat to users who reused passwords on other services.

How Plaintext Password Breaches Work

When a platform stores passwords in plaintext, an attacker who gains database access, whether through SQL injection, a misconfigured server, or an insider, walks away with a fully usable credential list. No post-breach processing is required. The attacker exports the database, uploads it to a forum or marketplace, and buyers immediately begin testing those credentials against Gmail, banking portals, streaming services, and anywhere else people tend to reuse passwords. Platforms that use proper password hashing force attackers to expend significant computing resources to crack even a fraction of the passwords. Plaintext storage eliminates that barrier entirely.

Check If You Are Affected

If you had an account on SonicStream or used the same email and password combination on any other platform, your credentials are likely already in active circulation. HEROIC's free dark web scanner checks your email against more than 400 billion exposed records to show you exactly where your data has appeared. Run a free scan now and find out before an attacker does.