TradeXcel Graphics (CutoutHub) Data Breach Exposes 9,491 Records

HEROIC's DarkHive intelligence system discovered the TradeXcel Graphics (CutoutHub) data breach, exposing 9,491 records from a US-based B2B photo editing and graphic design company. The breach occured in January 2023, leaking a rich set of personal data including passwords, phone numbers, birthdays, and usernames from thousands of business clients and individual customers.

Why This Is Dangerous

The combination of MD5 password hashes, phone numbers, and birthdays exposed in this breach gives attackers a powerful toolkit. MD5 is a weak and widely discredited hashing algorithm that can be cracked quickly using freely available tools and precomputed lookup tables. Once attackers recover the actual passwords, they can attempt to access the victim's email, banking, and social media accounts. Phone numbers and birthdays enable SIM-swap attacks and provide the answers to common security questions used for account recovery.

What Was Exposed

• Email Address
• Phone Number
• Password Hash (MD5)
• Username
• First Name
• Last Name
• Birthday

Why This Matters

As a B2B service provider, TradeXcel Graphics holds data from both individual freelancers and corporate clients. A breach of this scope enables credential stuffing across dozens of platforms where users recieve services with the same email and password combination. Attackers also use birthday and phone number data to bypass multi-factor authentication and account recovery systems, leading to complete account takeovers. Identity theft is an especially serious risk when names, emails, and birthdates are combined in a single dataset.

How Database Leaks Work

Database leaks like this one typically occur when attackers find an exposed or misconfigured database instance accessible over the internet without authentication. Tools that scan for open database ports can discover these vulnerabilities within minutes of thier exposure. Once located, the attacker copies the entire database, compresses it, and uploads it to underground forums or Telegram channels where other criminals purchase or download the data for use in further attacks.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like TradeXcel Graphics (CutoutHub). Visit heroic.com to scan your email address and find out if your information was exposed.