Your Password May Be Exposed: The Xat Breach Hit Over 5 Million Users

HEROIC analysts identified a major database breach connected to Xat, an online chatroom platform used to power chat widgets on other websites, dated November 3, 2015. The breach exposed 5,062,521 records, including usernames, email addresses, IP addresses, and passwords stored in plaintext.

Why the Xat Breach Is Dangerous

Plaintext password storage means there is nothing to crack. Anyone who obtained this dataset had immediate, working logins for more than five million accounts from day one. Because Xat was embedded as a chat widget across many other sites, users may not even remember creating an account, making them less likely to have changed that password since.

What Was Exposed in the Xat Leak

• Usernames
• Email addresses
• IP addresses
• Passwords, stored in plaintext

Why This Matters

At more than five million accounts, this breach is large enough to power widescale credential stuffing campaigns, where attackers automatically test each stolen email and password pair against banking sites, email providers, and shopping accounts. Because the passwords were never hashed, there is no delay between the leak and an attacker having a working login.

How Database Breaches Like This Happen

A database breach means an attacker gained direct access to Xat's backend storage and extracted the full user table. Storing passwords in plaintext, rather than hashing them, is considered a serious security failure, and it is the main reason this incident carries more risk than a similarly sized breach that used even basic password hashing.

Check If You Are Affected

If you ever created a Xat account, whether directly or through a chat widget on another site, check your exposure now. HEROIC's free breach scanner checks your email against more than 400 billion compromised records, including this one, in seconds.