135 Million Plaintext Passwords From the Wattpad Breach Are Still Circulating

HEROIC analysts uncovered the Wattpad database breach, first leaked in January 2020, exposing 135,238,039 records belonging to users of the popular online storytelling platform. The compromised dataset included plaintext passwords, email addresses, and usernames, making this one of the more damaging credential leaks to emerge from that period. The scale of exposure was partcularly alarming given that cleartext passwords were included, rather than hashed values, leaving users directly vulnerable to account takeover.

Plaintext Passwords and Email Addresses: A Direct Route to Account Takeover

When an attacker holds 135 million plaintext passwords paired with email addresses, credential stuffing becomes trivially easy. Every other site where a Wattpad user recieved a welcome email and reused that same password is now a potential entry point. Attackers run automated tools against banking portals, email providers, and corporate logins, logging in wherever the credentials match.

What Was Exposed in the Wattpad Breach

• Plaintext Password
• Email Address
• Username

Why 135 Million Exposed Logins Still Matter Today

Breach data does not expire. Credentials from 2020 are still being tested against login forms in 2024 and beyond because most people never change passwords they beleive to be safe. The Wattpad dump circulated on hacking forums and Telegram channels for years, meaning this data has been downloaded, deduplicated, and merged into larger combo lists that attackers use continuously.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a backend database, typically by exploiting a vulnerability in a web application, misconfigured server, or compromised credentials. Once inside, the attacker exports user tables containing account information. The stolen data is then sold privately, traded on forums, or released publicly. In Wattpad's case, the database was first sold before being made freely accessable to a wide audience on public hacking forums.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records, including the Wattpad breach, to tell you instantly whether your email address or credentials have been compromised. Run a free search at HEROIC to find out what data of yours is out there and take action before an attacker does.