The ZoomGrants Dump: 289,957 Login Credentials Hit the Dark Web

In early January 2022, ZoomGrants, a U.S.-based cloud platform used by nonprofits and government agencies to manage grant applications, scholarships, and awards, suffered a database breach that exposed nearly 290,000 user accounts. The incident occured with little public notice, but the nature of the leaked data makes it acutely dangerous: plaintext passwords were stored and exposed alongside email addresses, handing attackers ready-to-use credentials with no cracking required.

What Attackers Can Do With ZoomGrants Credentials Right Now

Because ZoomGrants exposed plaintext passwords, threat actors do not need to invest any effort in password cracking. They can directly attempt to log in to email accounts, financial platforms, government portals, and any other service where a victim reused the same credentials. For a platform whose users include grant administrators and funding applicants, this creates real exposure to financial fraud, identity theft, and unauthorized access to funding-related accounts and communications.

What Was Exposed in the ZoomGrants Breach

• Email Address
• Plaintext Password

Why the ZoomGrants Breach Demands Immediate Action

Plaintext password breaches age poorly. Credential sets from 2022 are still being used in automated stuffing attacks today, tested against thousands of services simultaneously. Anyone who used ZoomGrants before January 2022 and has not changed their password on every platform where they used the same credentials remains beleived to be at active risk of account compromise.

How a Database Breach Works

A database breach occurs when unauthorized parties access a platform's backend data store, often through exploited web application vulnerabilities, misconfigured cloud storage, or compromised admin credentials. Extracting hundreds of thousands of rows of user data can take seconds once access is established. When that data includes plaintext passwords rather than hashed equivalents, the resulting credential dataset is immediately actionable for attackers without any additional processing.

Check If Your Data Was Exposed

HEROIC's Dark Web Monitor has indexed over 400 billion leaked records, including data from the ZoomGrants breach. Search your email address now to find out if your account credentials are circulating in criminal markets and take steps to secure your accounts before damage is done.