UPIAR Store Data Breach Exposes 122,585 Italian Publisher Records

HEROIC's DarkHive intelligence system discovered the UPIAR Store data breach, exposing 122,585 records in August 2018. UPIAR Store is an Italian publisher specializing in UFO research literature and nonfiction works, operating as part of a cooperative tied to the Italian UFO research community. The compromised data included email addresses and plaintext passwords, meaning victims' credentials were stored and exposed in an unencrypted format with no protection whatsoever.

Why This Is Dangerous

Plaintext passwords represent the most severe form of password exposure because attackers do not need to crack or decode anything. The exact credentials used on UPIAR Store are immediately available for use in unauthorized login attempts across any other service. With 122,585 plaintext credentials exposed, this breach provides attackers with a ready-to-use credential list for widespread account takeover campaigns targeting email, banking, and social media platforms.

What Was Exposed

• Email Address
• Plaintext Password

Why This Matters

Credential stuffing attacks using plaintext passwords are among the most effective account takeover methods because the success rate is significantly higher than with cracked hashes. Attackers automate the testing of these email and password pairs across hundreds of popular services, including banking portals, e-commerce sites, and cloud storage platforms. Users who reused their UPIAR Store password anywhere else faced immediate and ongoing risk of account compromise the moment this breach data entered dark web circulation.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to a website's backend systems through vulnerabilities such as SQL injection, misconfigured databases, or compromised administrative credentials. The fact that UPIAR Store stored passwords in plaintext rather than using a secure hashing algorithm indicates poor security practices, which likely made the site an easier target. Stolen databases are packaged and sold on dark web forums and shared on Telegram channels, where they fuel ongoing waves of credential stuffing attacks.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the UPIAR Store breach. Visit heroic.com to check if your information was exposed.