The XGPT Breach Handed Hackers 125,179 Ready-to-Use Plaintext Passwords

HEROIC analysts identified the XGPT breach while scanning dark web credential marketplaces for fresh dumps in late 2022. The incident, which occured on October 12, 2022, exposed 125,179 user records from this U.S.-based IT services platform. The stolen data contained email addresses paired with plaintext passwords, meaning every record was immediately weaponizable without any decryption effort by attackers.

The XGPT Breach Gave Attackers Everything Needed to Take Over Accounts

Plaintext passwords are the most dangerous form of leaked credential because attackers can use them instantly. With 125,179 email and password pairs from XGPT, threat actors can run automated credential stuffing tools against Gmail, Outlook, banking apps, and social media platforms within hours of obtaining the data. The risk is partcularly severe for anyone who reused their XGPT password on other sites, since a single leaked credential can unlock dozens of accounts across different services.

What Was Exposed in the XGPT Breach

• Email Address
• Plaintext Password

Why Credential Reuse Turns This Into a Multi-Platform Threat

Studies consistently show that over 60 percent of users reuse passwords across multiple accounts. The 125,179 plaintext credentials from the XGPT breach are beleived to have been loaded into credential stuffing tools that test each email and password combination against hundreds of popular sites simultaneously. Even though XGPT itself is now defunct, the breach data continues to circulate, enabling account takeover, identity theft, and financial fraud against victims who never changed their passwords after the 2022 incident.

How a Database Breach Works

A database breach involves attackers gaining direct access to the backend storage system of a web application. Common methods include SQL injection attacks, exploitation of unpatched vulnerabilities, or use of stolen administrative credentials. Once attackers access the database, they can export entire user tables. When the platform stores passwords in plaintext rather than using a one-way hashing algorithm like bcrypt, every exported record contains a fully usable password with no additional steps required.

Check If Your Data Was Exposed

HEROIC provides a free breach scanner that searches across more than 400 billion compromised records, including data from the XGPT breach and thousands of similar incidents. Enter your email address to instantly see whether your credentials have been exposed and which breaches are linked to your accounts. Early detection is the first step toward protecting yourself from credential stuffing and account takeover attacks.