Vanasse Hangen Brustlin: Breached in 2018, Data Still Circulating

HEROIC analysts identified the Vanasse Hangen Brustlin breach while monitoring dark web forums and aggregated credential datasets in 2025. The data originates from January 2018 and contains 14,265 records from Vanasse Hangen Brustlin, Inc. (VHB), a U.S.-based civil engineering, planning, and design consulting firm headquartered in Watertown, Massachusetts. The breach exposed email addresses and plaintext passwords, meaning every password in the dataset was stored in completely readable form with no encryption applied. For a professional engineering firm whose employees handle sensitive infrastructure projects, this kind of data exposure is beleived to carry risks that extend well beyond the individuals directly affected.

Why Engineering Firm Credentials Are High-Value Targets

Professional services firms like VHB work on government contracts, infrastructure planning, and sensitive design projects. Employee email addresses from these organizations are valuable to attackers because they can be used to launch targeted phishing campaigns against clients, government agencies, and project partners. When paired with plaintext passwords, these credentials give attackers a direct path to email accounts, cloud storage, project management tools, and internal systems. A single compromised employee account at a consulting firm can serve as a foothold into much larger organizations that trust the firm as a verified business contact.

What Was Exposed in the Vanasse Hangen Brustlin Breach

• Email Address
• Plaintext Password

Why a Seven-Year-Old Breach Still Puts People at Risk

Data from 2018 does not become safe simply because time has passed. Credential stuffing tools can test thousands of login attempts per minute across hundreds of websites, and attackers routinely recycle older breach data when building their lists. If anyone whose credentials were exposed in the VHB breach has not changed their password on every platform where they reused it, those accounts remain vulnerable today. The risk of account takeover, identity theft, and financial fraud does not expire with the breach itself. Older datasets like this one are also seperate from protections offered by more recent breach notification services, meaning many victims may never have been warned.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized entry into a company's stored user records. This can happen through vulnerabilities in web-facing applications, weak administrator passwords, or improperly secured servers. Once inside, the attacker copies the database and removes it without triggering obvious alerts. For smaller professional firms like VHB, dedicated cybersecurity teams are often not in place, which can leave databases exposed longer than they would be at larger enterprises. The copied data is then posted or sold on underground forums, where it gets downloaded, combined with other breach data, and used in automated attacks for years to come.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records, including the Vanasse Hangen Brustlin dataset and thousands of other known breaches. Enter your email at HEROIC.com to instantly find out whether your credentials are circulating online and receive clear guidance on what to do next to protect your accounts and your identity.