ToffeeWeb Data Breach: 16,280 Everton Fan Records Exposed

Blue Side Down: ToffeeWeb's 2018 Plaintext Password Breach

ToffeeWeb has been one of the internet's longest-running fan sites for Everton FC -- online since 1994 and providing Toffees supporters with match analysis, history, forums, podcasts, and comunity content for three decades. In August 2018, this beloved institution suffered a data breach exposing 16,280 user accounts with passwords stored in plaintext. Fan sites with active forum communities hold more valuable data than they typically realise -- and the footbal enthusiast demographic presents specific credential reuse risks.

ToffeeWeb (August 2018): Breach Summary

• Records Exposed: 16,280
• Data Types: Email addresses, plaintext passwords
• Breach Type: Database breach
• Password Type: Plaintext -- credentials immediately readable; no hashing or encryption applied
• Country: United Kingdom
• Date Leaked: August 26, 2018

Football Fan Credentials: A Specific Stuffing Target

Football fan sites attract a dedicated, passionate user base that registers to participate in forums, prediction competitions, and match commentary. This community tends to register on multiple football-related platforms -- official club websites, Fantasy Premier League, Opta fan platforms, Sky Sports, and BT Sport -- using consistent usernames and passwords across all of them.

Attackers who run stuffing campaigns against Premier League team accounts -- including the official Everton FC website, Goodison Park hospitality booking systems, and club merchandise stores -- will use databases from fan sites like ToffeeWeb as source material. A 16,280-record plaintext credential set from a verified Everton community is a useful asset for anyone targeting the club's digital ecosystem.

UK Fan Site Forum Security: A Legacy Problem

Community fan sites built in the early 2000s often ran on forum software with legacy security practices. Sites like ToffeeWeb -- built for passion rather than profit, typically maintained by volunteers or small teams -- were rarely subject to professional security audits. The use of plaintext passwords in 2018 reflects a system that may have been built in an era when such practices were common and simply never updated to modern hashing standards.

This pattern is not unique to ToffeeWeb. Dozens of long-running UK sports community sites from the same era have similar security debt, having accumulated years of user data without ever modernising their authentication infrastructure.

The August 26, 2018 Cluster and UK Sport

ToffeeWeb's breach occurred on the same date as multiple other UK-origin exposures in the August 26, 2018 cluster. UK-focused fan platforms, hobby sites, and community portals appear repeatedly in this batch, consistent with systematic exploitation of common UK hosting environments or a deliberate collection of UK community data released simultaneously.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including UK sports community platform breaches like ToffeeWeb. If you ever registered on this or any other fan forum using a shared password, check whether those credentials are circulating in active combolists.