How the Swvl Database Breach Led to 4.2 Million Stolen User Records

HEROIC analysts determined that the Swvl breach occured in June 2020, affecting 4,194,131 users of the Egyptian bus transportation platform. The compromised data included email addresses, phone numbers, bcrypt password hashes, first names, and last names, all of which were circulated in online hacking communities. The scale of the incident and the variety of personal information exposed makes this one of the more significant breaches to emerge from the Egyptian technology sector.

How Full Names, Phone Numbers, and Emails Enable Targeted Attacks

With full names, email addresses, and phone numbers combined, attackers can craft highly convincing phishing messages and SIM-swap attempts. Even though bcrypt password hashes are resistant to brute-force cracking, the remaining personal data is more than sufficient for identity fraud, account takeover through social engineering, and targeted vishing calls. This combination is partcularly dangerous because it provides everything needed to impersonate a victim to customer support teams across financial, telecom, and government services.

What Was Exposed in the Swvl Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name

Why 4 Million Transportation App Users Face Ongoing Fraud Risk

Data from transportation platforms is recieved with less urgency by victims than data from banking or healthcare breaches, yet it carries substantial real-world risk. Swvl users who shared their names, emails, and phone numbers with the platform now have that information accessable in hacking communities, where it can be paired with other leaked datasets to build richer profiles. Social engineering attacks using verified personal details from this breach may continue for years after the original incident.

How Database Breaches Work

A database breach occurs when an attacker compromises a company's backend data store, typically by exploiting application vulnerabilities, misconfigured cloud storage, or stolen administrative credentials. Once the database is accessed, records are exported and the data is distributed across underground forums and Telegram channels. Larger breaches like Swvl attract ongoing interest from cybercriminals because the sheer volume of verified personal records provides a high return on exploitation effort.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion records, including data from the Swvl breach and thousands of other known incidents. Search now at HEROIC to find out whether your name, email, or phone number is currently in circulation among threat actors.