Our Analysts Found the UISO Breach Circulating on Dark Web Forums

HEROIC analysts found the UISO dataset while scanning aggregated credential collections circulating on dark web forums in 2025. The breach traces back to January 2018 and affected 274,225 user accounts on UISO, a Canadian software platform used for managing CD and DVD disc images. The exposed data included email addresses and plaintext passwords, meaning the passwords were stored without any form of encryption or hashing. For a platform serving software users and tech-oriented individuals, storing credentials in plaintext is a partcularly serious security failure, and the data has now resurfaced in combined breach lists that make it easy for attackers to exploit.

What Attackers Can Do with 274,000 Email and Password Pairs

A list of 274,225 email addresses paired with readable plaintext passwords is exactly what credential stuffing operations need. Attackers feed these pairs into automated bots that test the combinations across banking sites, email providers, streaming services, and corporate login portals. Because many people reuse passwords across multiple sites, a large share of these credentials will still work somewhere. The accounts that get broken into can be drained of funds, used to send spam, sold on fraud markets, or leveraged for further access into corporate networks if the registered email belonged to an employee.

What Was Exposed in the UISO Breach

• Email Address
• Plaintext Password

Why the UISO Breach Remains a Threat Today

Even though this breach occured in 2018, the data continues to circulate and be combined with newer breach dumps, making the credentials more dangerous over time rather than less. Credential stuffing attacks, account takeover schemes, and identity theft operations rely on exactly this kind of older data appearing in fresh aggregated lists. If you registered on UISO and have not changed that password on every site where you may have reused it, those accounts remain vulnerable. The longer exposed credentials go unchanged, the more opportunities attackers have to find and exploit them.

How Database Breaches Work

A database breach occurs when an unauthorized person gains access to the stored records of a website or online service. Attackers typically get in by exploiting vulnerabilities in web software, using phishing attacks to steal administrator credentials, or finding databases that are misconfigured and openly accessible on the internet. Once access is gained, the attacker exports the user table containing all registered account details. For UISO, that meant 274,225 rows of email addresses and plaintext passwords. These records are then traded or sold on underground forums, often showing up years later in larger aggregated datasets.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers more than 400 billion records, including the UISO breach and thousands of other known data exposures. Enter your email at HEROIC.com to instantly see whether your credentials are circulating on the dark web and get step-by-step guidance on securing your accounts before someone else uses your password against you.