Breach at free webhosting service 000Webhost leaks 13M names, passwords, and email addresses
13 million plaintext passwords belonging to webhost users leaked online — Personal data is exposed as a result of a five-month-old hack on 000Webhost. — A security researcher has discovered …
Context & Ripple Effects
This 2015 breach is an early data point in the credential-dump economy the later coverage documents: stolen account lists surfacing in bulk, then getting indexed and resold. The pattern runs from hashed-password corpora like Last.fm's 43.57M stolen accounts — where weak hashing let nearly everything be cracked fast — to the "Collection #1" database of ~773M email addresses that aggregated breaches into a single searchable pile.
What distinguishes 000Webhost is the plaintext storage: 13 million passwords exposed with no hashing to slow anyone down. That same supply of leaked credentials later fed resale markets like WeLeakInfo, whose domain the FBI eventually seized after the site advertised 12B+ username/password pairs.
First-order effects
- 13 million 000Webhost users have their names, emails, and reusable passwords exposed simultaneously — anyone reusing those credentials on other services is compromised immediately, not eventually.
Second-order effects
- Plaintext dumps like this one become raw inventory for credential-stuffing operations and breach-aggregation sites; the corpus shows the downstream market maturing from cracked hashes (Last.fm) to searchable mega-collections (Collection #1) to outright retail (WeLeakInfo).
Third-order effects
- If free-tier hosting providers keep storing passwords unhashed while dump-market infrastructure persists, enforcement against resale venues becomes a structural lever — the FBI's seizure of WeLeakInfo signals law enforcement treating breach-data commerce as a targetable industry rather than a series of one-off incidents.
The trend: Credential breaches are consolidating from isolated incidents into an aggregated resale market, pushing the fight from prevention at individual hosts toward enforcement against the brokers who index and sell the dumps.