The Wishbone 2020 Leak Has More Accounts Than the Population of Virginia

HEROIC analysts identified the Wishbone breach dating to January 2020, in which 8,739,370 user records were exposed from the popular mobile comparison app. The leaked dataset contained email addresses and plaintext passwords, meaning passwords were stored in cleartext with no hashing applied. This occured at a time when such practices were already widely condemned, making the exposure seperate from ordinary credential risk and placing affected users at immediate threat of account takeover across any platform where they reused that password.

Plaintext Passwords Paired With Email Addresses Enable Instant Credential Stuffing

Unlike hashed passwords that require cracking time, plaintext passwords are recieved by attackers in ready-to-use form. With 8.7 million email-password pairs, bad actors can immediately launch automated stuffing attacks against Gmail, banking apps, social networks, and workplace tools. Any account where a Wishbone user reused the same credentials is directly at risk without any additional effort from the attacker.

What Was Exposed in the Wishbone (2020) Breach

• Email Address
• Plaintext Password

Why a Comparison App Breach Is a Corporate Security Problem

People use personal email addresses and favorite passwords across personal apps and work accounts alike. When a Wishbone user's plaintext password enters the breach ecosystem, attackers test it against corporate VPNs, email systems, and SaaS tools. Security teams partcularly struggle to defend against this because the compromised credential looks like a legitimate login. Multi-factor authentication and continuous credential monitoring are the primary defenses.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to a company's backend database, usually through a web vulnerability, exposed credentials, or a misconfigured server. Once inside, user tables are exported and the data is sold or published on underground forums. In Wishbone's case, the 2020 breach data has been widely circulated on Telegram channels and credential stuffing communities, keeping it actively dangerous years after the initial incident.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers more than 400 billion records, including the Wishbone (2020) breach. Enter your email address to find out instantly whether your credentials have been compromised and get guidance on securing your accounts before an attacker acts first.