YourVersion Data Breach Exposes 22,578 User Accounts

HEROIC's DarkHive intelligence system discovered the YourVersion data breach, exposing 22,578 records. The breach occured in February 2018, targeting users of this US-based search engine platform. The compromised data includes email addresses and SHA1 password hashes, putting tens of thousands of users at risk of credential attacks even years after the original incident.

Why This Is Dangerous

SHA1 is a deprecated hashing algorithm that security researchers consider insufficiently strong for password storage. Modern cracking rigs can process billions of SHA1 hashes per second using GPU acceleration, meaning many passwords in this breach can be recovered in hours or less. Attackers who crack these passwords then test them against email providers, banking sites, and social media platforms using automated credential stuffing tools. YourVersion users who reused thier passwords on any other service remain at ongoing account takeover risk.

What Was Exposed

• Email Address
• Password Hash (SHA1)

Why This Matters

Even small breaches contribute to large-scale credential stuffing campaigns. Criminals aggregate data from hundreds of smaller breaches like YourVersion into master combolists containing millions of email and password pairs, which they test automatically against popular online services. Users who shared thier YourVersion password with banking, email, or work accounts face active compromise risk. Email addresses from the breach also enable targeted phishing attacks, where criminals send convincing fraudulent messages designed to steal additional personal and financial information from victims.

How Database Breaches Work

Database breaches happen when attackers exploit weaknesses in a web application, such as SQL injection flaws or misconfigured servers, to gain unauthorized access to the backend database. Once inside, they export user tables containing account credentials in bulk. These exports are then uploaded to dark web forums and Telegram channels where other criminals purchase or download them for use in credential stuffing attacks. The data from older breaches like YourVersion continues to circulate in these communities for years, making the threat persistent long after the original compromise occured.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like YourVersion. Visit heroic.com to scan your email address and find out if your information was exposed.