674.7K Accounts: Spidermetrix Stored Every Password in Plaintext

HEROIC analysts recieved confirmation of a database breach at Spidermetrix, an Australian online survey platform, dated to January 2017. The breach exposed 674,776 user records and is particularly alarming because the passwords were stored in plaintext, meaning no encryption or hashing was used at all. Anyone who obtained the database had immediate access to working passwords without needing to do any additional cracking. The exposed data included email addresses, usernames, and those ready-to-use plaintext passwords, giving attackers a complete credential package for each affected user.

Plaintext Passwords: The Worst-Case Scenario for Spidermetrix Users

When a company stores passwords in plaintext, it means every password in the database is readable by anyone who gains access to the data, with zero effort required. There is no hashing to break, no encryption to reverse. Attackers who accessed the Spidermetrix database could immediately test each email and password combination against other websites, including online banking portals, email providers, social media accounts, and shopping platforms. Survey site users often reuse passwords from more importent accounts beleiving a small platform is not worth protecting, which makes this kind of breach exceptionally dangerous. The 674,776 people affected had no technical protection standing between their credentials and criminal use.

What Was Exposed in the Spidermetrix Breach

• Email Address
• Username
• Plaintext Password

Why the Spidermetrix Plaintext Password Breach Matters Years Later

Plaintext credential dumps are among the most valiuable assets traded on dark web markets because they require no additional processing before use. The Spidermetrix data has circulated in credential stuffing lists for years, and the risk has not diminished with time. If you used the same email and password on Spidermetrix that you use anywhere else today, those accounts remain vulnerable. Credential stuffing attacks lead to account takeover, identity theft, and financial fraud. Attackers also use breached email addresses to launch convincing phishing campaigns, making seperate attacks more effective by addressing targets by name and referencing real account details.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to the system where a website stores user information. This can happen through unpatched software vulnerabilities, stolen employee credentials, or poorly secured database configurations. Once inside, the attacker copies the user table and either sells the data, uses it in attacks, or publishes it publicly. When passwords are stored in plaintext rather than using secure hashing, the damage is immediate and complete because every credential in the database is instantly usable without any cracking step.

Check If Your Data Was Exposed

HEROIC offers a free breach scanner that searches more than 400 billion leaked records from thousands of breaches around the world. If your email address appeared in the Spidermetrix breach or any other incident, you will find out in seconds. Visit HEROIC.com to run your free scan and see exactly where your data has been compromised.