Suposta base de dados de clientes da HomeMaison · Breach

Alleged HomeMaison database includes 330,000 plaintext passwords

Nov 12, 2026 · 1 min read

An actor is selling an alleged HomeMaison database containing 36.4 million records across 471 files. The listing cites about 1.6 million email addresses, 1.3 million phone numbers, and 330,000 customers with plaintext passwords. Customers should change reused passwords.

By HIFY Radar newsroom Updated 11/12/2026 07:50 PM Get this every day →← Back to the feed 2 sources

HighBreachNo software to update

In 30 seconds

Alleged

The latest substantive report says a threat actor is offering an alleged HomeMaison database containing 36.4 million lines, including about 330,000 customer passwords supposedly stored in plaintext. The report explicitly says the seller's claim remains unverified.

What happened

Alleged

A Reddit report attributes the listing to an actor using the name Chimera. It says the seller is taking offers, requests payment in XMR and accepts escrow for an archive allegedly associated with HomeMaison.

Why it matters

Inferred

If the plaintext-password claim is accurate, anyone who reused a HomeMaison password elsewhere could face credential stuffing, where attackers automatically try exposed login details on other services. The contact and order data described by the seller could also make phishing messages more convincing.

What to do

Inferred

As a precaution, customers should replace any password used for HomeMaison and change it everywhere else it was reused. Use unique passwords, enable multifactor authentication where available and treat unexpected messages about orders, deliveries or account problems with suspicion. These steps address the reported risk without assuming the dataset is authentic.

Confirmed and still uncertain

Observed

The available reports establish that a sale listing was publicized, but they do not independently establish that the data is genuine, complete or obtained from HomeMaison systems. The method of acquisition, the number of distinct people involved and whether HomeMaison has confirmed an incident remain unknown in this evidence batch.

What people are saying

Observed

DailyDarkWeb labels the material an unverified threat-actor claim and frames credential stuffing and phishing as conditional risks. The Reddit report similarly says researchers documented the listing and visible samples but did not verify the underlying archive's authenticity or completeness.

Evolution

Observed

An earlier Reddit report supplied the alleged seller name, transaction terms and file formats. A later DailyDarkWeb post repeated the core volume and exposure claims while emphasizing that the listing had not been verified. The later report adds caution, not confirmation.

Reach

Observed

2 independent groups, 2 updates, and 0 engagements. Observed communities: r/pwnhub.

Technical detail

Inferred

The listing reportedly describes 36,418,034 lines distributed across 471 CSV and JSONL files, totaling 10.4 GB and spanning data dated from 2008 through 2026. A line count is not necessarily a count of unique records or people, because one customer can appear in multiple tables, orders or files.

Sources and evidence

Observed

The useful evidence consists of two secondary social-media reports describing the alleged listing. This batch provides no HomeMaison statement, independently validated dataset, forensic report or direct proof of unauthorized access, so attribution to Chimera and every claim about the archive must remain provisional.