How the ZoomOx Breach Exposed 22,824 Accounts After Shutdown

HEROIC analysts came across the ZoomOx breach while reviewing a collection of database dumps that appeared in August 2018. ZoomOx was a now-defunct U.S.-based novelty platform where users could claim digital ownership of real-world cities. At the time of the breach, 22,824 user accounts were exposed, each containing an email address and an MD5 password hash. What makes this case noteworthy is that the platform had already ceased operations, yet the user data still made its way into circulation. The ZoomOx records have since occured in multiple credential dump collections traded across underground communities.

Why a Defunct Platform's MD5 Hashes Still Threaten Your Active Accounts

When a website shuts down, many users assume their data disappears with it. That is not how data breaches work. The ZoomOx database was extracted and shared before or during the platform's closure, and the MD5 password hashes it contained can be cracked using tools that are recieved freely online. Once an attacker recovers the original password from an MD5 hash, they can test it against your current email, social media, and financial accounts. A forgotten sign-up on a novelty city platform becomes a liability for every account where you reused that password.

What Was Exposed in the ZoomOx Breach

• Email Address
• Password Hash (MD5)

Why Old Breach Data From Shutdown Sites Keeps Causing Harm

Data from defunct platforms does not expire. Credential stuffing attacks do not care whether the original site still exists. Attackers buy, trade, and compile old breach data to build large credential lists that they test against active services. If your ZoomOx email and password combination matches what you use on a banking site, a shopping account, or your workplace login, you are at risk of account takeover, identity theft, and financial fraud, even years after the platform went offline. The longer old credentials go unaddressed, the longer they remain useful to attackers.

How a Database Breach Works

A database breach occurs when an attacker gains access to a website's backend and extracts the stored user records. In ZoomOx's case, the breach resulted in a structured file containing email addresses and MD5 password hashes being distributed through hacker communities. Database breaches can happen through vulnerabilities in web application code, misconfigured servers, or compromised administrator credentials. Once the data is extracted, it is nearly impossible to contain, and it continues circulating long after the original incident.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers more than 400 billion records from data breaches worldwide, including legacy incidents like ZoomOx. Enter your email address to find out if your credentials were part of this breach or any other known incident. Scan for free at HEROIC.com and know exactly where your data has been exposed.