The Wanadoo.fr Database Contains Exactly 1,875,397 Plaintext Passwords

HEROIC analysts recieved a confirmed database extract from Wanadoo.fr, a legacy French internet service provider, showing 1,875,397 user records exposed in a breach dated December 2016. The data is partcularly alarming because passwords were stored and leaked in plaintext, meaning no cracking is required at all. Any attacker with this file has immediate, ready-to-use credentials for nearly two million French internet accounts.

Plaintext Passwords From Wanadoo.fr: The Worst-Case Credential Leak

Most breaches expose hashed passwords that take time and computing power to crack. The Wanadoo.fr breach is different. Passwords were stored without any protection, so they were stolen exactly as users typed them. Attackers can load this list directly into credential stuffing tools and begin testing logins against email providers, banking sites, and streaming services without any additional work. Anyone who used the same password on Wanadoo.fr and another service is accessable to immediate account takeover.

What Was Exposed in the Wanadoo.fr Breach

• Email addresses
• Plaintext passwords
• Usernames
• Account credentials tied to French ISP accounts

Why a Decade-Old French ISP Breach Still Matters for Account Security

Wanadoo.fr was one of France's largest internet providers before being absorbed by Orange S.A. in 2006, but its legacy user accounts remained active for years afterward. Millions of French users kept these email addresses as their primary login across other services. A credential from 2016 that was never changed is just as useful to an attacker today as it was the day the breach occured. These credentials fuel credential stuffing, account takeover, identity theft, and in some cases financial fraud when banking credentials are reused.

How Database Breaches Work

A database breach happens when attackers find a way into the systems where a website stores its user records. Common entry points include unpatched software, stolen administrator credentials, or misconfigured servers left open to the internet. Once inside, attackers export the user database, which can contain millions of records, in a matter of minutes. The stolen data is then packaged and sold or distributed across criminal forums and encrypted messaging apps.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records, including the Wanadoo.fr database and thousands of other known breaches. Visit HEROIC.com to run a free search and find out exactly which of your accounts have been compromised so you know which passwords to change first.