The Sunrose Consulting Leak: 89K Plaintext Passwords Exposed

HEROIC analysts discovered the Sunrose Consulting database circulating on a dark web forum in connection with a breach that occured in August 2018. The Lagos-based HR consulting and training firm had 89,581 user records exposed, each containing an email address and a plaintext password. Because the passwords were stored without any hashing, they were immediately usable by anyone who obtained the dataset. The firm's role as an HR consultancy makes the breach partcularly significant, as HR platforms routinely hold sensitive employee and client data that extends well beyond basic account credentials.

When HR Data Leaks: What Attackers Can Do with Consulting Firm Credentials

HR consulting platforms handle onboarding records, candidate profiles, and client company contacts. Attackers who obtain plaintext credentials from Sunrose Consulting can attempt logins across corporate email systems, HR software, and payroll portals where the same passwords were reused. Access to an HR email account opens pathways for business email compromise, fraudulent wire transfers, and identity theft targeting both the firm's staff and the client companies they serve.

What Was Exposed in the Sunrose Consulting Breach

• Email Address
• Plaintext Password

Why This Breach Still Matters Years After It Happened

Old breaches do not expire. The Sunrose Consulting credentials have been recieved by new audiences on dark web markets long after 2018, meaning the attack surface keeps expanding. Credential stuffing tools run these email-and-password pairs against dozens of platforms simultaneously. Account takeover, identity theft, and financial fraud are all realistic outcomes for users who recycled their password across services. Nigeria's growing digital economy also means these accounts may connect to financial platforms that did not exist when the breach first occurred.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to an organization's data store, typically through a web application vulnerability, misconfigured database server, or stolen administrative credentials. Once access is established, user tables are exported. When passwords are stored in plaintext, as they were in the Sunrose Consulting breach, the exported data requires no additional processing. The attacker has working credentials from the moment the export completes.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records, including the Sunrose Consulting dataset. Find out in seconds whether your credentials have been exposed and what steps to take next. Run your free scan at HEROIC today.