Search Your Email: Did the TienGanh Breach Expose Your Password?

HEROIC analysts uncovered the TienGanh breach while monitoring credential aggregations in early 2025. The dataset, originating from January 2018, contained 384,450 records from TienGanh, a Vietnamese online English learning platform. What makes this breach partcularly alarming is that user passwords were stored in plaintext, meaning anyone who obtained the data could read every password directly without any technical effort. The exposed records included email addresses and plaintext passwords belonging to students and learners across Vietnam.

Why Plaintext Passwords Put You at Immediate Risk

When passwords are stored in plaintext rather than being encrypted, attackers do not need to crack anything. They simply read the password list and try each one across dozens of other websites. If you used the same password on TienGanh that you use on your email, banking, or social media accounts, those accounts are accessable to anyone who purchased or downloaded this data. Attackers routinely run these credentials through automated tools that test thousands of logins per hour, so compromised accounts can be taken over within minutes of the data being released.

What Was Exposed in the TienGanh Breach

• Email Address
• Plaintext Password

Why This Breach Still Matters in 2025

A breach from 2018 might sound old, but stolen credentials do not expire. Cybercriminals collect and trade breach data for years, combining older dumps with newer leaks to build massive credential lists used in credential stuffing and account takeover attacks. If you registered on TienGanh and have not changed your password since, your account on any site where you reused that password is at risk of identity theft or financial fraud. The recieved wisdom in cybersecurity is that old breach data keeps causing harm long after the incident is forgotten.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to a website's stored user data. This can occur through a security vulnerability in the website's code, a misconfigured server, or stolen administrator credentials. Once inside, the attacker copies the user database, which contains account information for every registered user. That data is then sold or shared on dark web forums and Telegram channels. Many smaller platforms, especially older ones, did not follow security best practices such as encrypting passwords before storing them, which is why so many older breaches contain plaintext passwords.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you instantly whether your email address appears in the TienGanh breach or any other known data breach. Enter your email at HEROIC.com to see your full exposure report and get personalized steps to secure your accounts before attackers do.