The Terry Holder Data Quietly Appeared on the Dark Web Back in 2018

HEROIC analysts found that the Terry Holder website, the official online home of a U.S. folk-rock singer-songwriter, suffered a database breach in August 2018 that exposed 90,137 user records. The compromised data included email addresses and plaintext passwords, meaning passwords were stored with no protection whatsoever. This breach recieved limited attention at the time, but the exposed credentials remain a threat to anyone who reused that password on other accounts.

What Fan Site Plaintext Passwords Mean for Your Other Accounts

When a website stores your password in plaintext, it means anyone who accesses the database can read your exact password with no effort at all. There is no hashing to crack, no encryption to break. Attackers who obtained the Terry Holder database immediatly had working passwords for over 90,000 accounts. If any of those users also used that password on their email, bank, or social media account, those accounts became vulnerable the moment the database was stolen. Password reuse is one of the most common causes of account takeover.

What Was Exposed in the Terry Holder Breach

• Email addresses
• Plaintext passwords

Why a Music Website Breach Can Hurt You in Unexpected Ways

Fans who created an account on terryholder.com likely used an email and password they also use elsewhere. Attackers who collected this data feed it into credential stuffing tools that automatically test the stolen combinations against hundreds of popular websites. The result can be unauthorized access to streaming services, online shopping accounts, and even financial platforms. Smaller fan and artist sites are particulary vulnerable because they often run on older software with minimal security oversight, making them easy targets for attackers looking for quick wins.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to the system where a website stores its user data. This can happen through exploiting a security flaw in the website's software, guessing or stealing an administrator's login credentials, or finding an improperly secured server. Once inside, the attacker can copy the entire database and disappear without triggering any alarms. Websites that store passwords in plaintext are especially damaging when breached because there is no additional step required to exploit the stolen data.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to check whether your email address appears in the Terry Holder breach or any of thousands of other known data leaks. Run your scan today and find out if your credentials are already being used against you.