[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flqx3l440vb64":3},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":7,"domain":9,"breachDate":10,"addedDate":11,"modifiedDate":12,"contentUpdatedAt":13,"source":14,"sourceUrl":15,"sourceUrls":16,"pwnCount":17,"affectedCount":17,"affectedCountStatus":18,"affectedCountLowerBound":19,"affectedCountUnit":20,"hasEnglishDescription":4,"severity":21,"dataClasses":22,"description":27,"seoTitle":15,"seoTitleEn":28,"seoDescription":15,"seoDescriptionEn":29,"logoUrl":30,"isVerified":4,"isSensitive":31,"isSpamList":31,"isMalware":31,"company":32},"68e3266eda11adda4882530c","phoenix","Phoenix Data Breach","phoenixim.ddns.net","2021-06-05T00:00:00.000Z","2023-10-17T02:27:58.000Z","2026-07-03T23:23:17.190Z","2026-07-18T23:55:51.730Z","Third party breach","",[],74776,"known",null,"unknown","Medium",[23,24,25,26],"Email addresses","IP addresses","Passwords","Usernames","\u003Cp>The Phoenix data breach is associated with the exposure of user accounts belonging to a service that revives old-fashioned messaging, which occurred in mid-2021. The scope is approximately 74,776 accounts. This record was treated as a messaging service account breach; the company, country, industry, website, and data class fields were realigned with the verified scope. Although the current text appears clean, the industry and country context have been corrected.\u003C\u002Fp>\u003Cp>The text was rewritten to directly explain the risk, scope, and action to the user. The website field was stored as phoenixim.ddns.net; a format that would cause https to appear twice on the connection side was not used since the protocol was not added. The industry was set to messaging and legacy chat service instead of Other, and the country was set to Global.\u003C\u002Fp>\u003Ch2>Leaking Data Types and Risks\u003C\u002Fh2>\u003Cp>The types of data seen in this record are email addresses, IP addresses, passwords, and usernames. Since there is a password field, other accounts using the same password are at risk. Unverified payment card, bank account, private message, health record, or additional profile fields were not added to the data class list; only the supported fields were left.\u003C\u002Fp>\u003Cp>Messaging identity and IP address can be used to match a user across different communities. An email address alone poses a risk of unwanted messages; when combined with a phone number, address, IP, date of birth, password, travel plans, partial card data, or device data, it becomes easier for an attacker to generate user-specific messages. The risk assessment was made according to this combined effect.\u003C\u002Fp>\u003Ch2>Verified Scope and Boundaries\u003C\u002Fh2>\u003Cp>The scope was verified with mid-2021 Phoenix account data. Confirmed fields were retained while unconfirmed fields were excluded. The event was not combined with similarly named datasets, events from different periods of the same company, or incorrect sector attributions.\u003C\u002Fp>\u003Cp>The registration is limited to the domain name phoenixim.ddns.net and has not been combined with other Phoenix brands. The domain name, company name, and industry information were kept in the narrowest accurate context possible. In places where there was uncertainty, a verified flag or website domain was set accordingly; thus, the user was not shown brand responsibility that was not definite.\u003C\u002Fp>\u003Ch2>User Groups at Risk\u003C\u002Fh2>\u003Cp>User groups at risk may include users registered with the Phoenix messaging service and individuals using the same username on different chat services. Matching users should also evaluate other accounts where they use the same email, phone number, username, or password pattern outside the relevant service.\u003C\u002Fp>\u003Cp>Passwords used in old messaging accounts may remain in current email or social accounts. If there is a context of corporate email, educational account, hotel reservation, telecom subscription, gaming community, open source donation, or tracking software, the social engineering risk may increase. Details that appear correct alone are not a sign of trust.\u003C\u002Fp>\u003Ch2>Urgent Measures to Be Taken\u003C\u002Fh2>\u003Cp>Affected users should change their Phoenix password and all accounts where the same password is used. For records with a password field, all accounts using the same password should be updated; for records without a password field, focus should be on the risk of email, phone, fake notifications, privacy, and identity matching.\u003C\u002Fp>\u003Cp>Instead of clicking on the links in the message, the address of the relevant service should be typed manually or the record in a trusted password manager should be used. Messages about shipping, account alerts, game rewards, support, donor notifications, travel reservations, security notifications, or subscription renewals should not be accepted without verification from an independent channel.\u003C\u002Fp>\u003Ch2>Long-Term Security Strategies\u003C\u002Fh2>\u003Cp>Using unique passwords and separate usernames on chat and forum accounts reduces the risk of identity matching. Users should regularly clean up old accounts, unnecessary profile fields, repeated usernames, and old phone and address information. A unique password for each service and two-factor authentication where possible should be the basic rule.\u003C\u002Fp>\u003Cp>From the perspective of service providers, data minimization, strong password protection, monitoring of access logs, deletion of unnecessary fields, and having user notification processes ready are required. Small messaging communities can also generate valuable data for password retry attempts. Accurate scope explanation is also part of security work; exaggerated or incomplete information can lead the user to take incorrect action.\u003C\u002Fp>\u003Ch2>Record Control and User Action\u003C\u002Fh2>\u003Cp>The user should first perform a check with the email address in this record. If a match is found, it should be assumed that the username, IP, and password fields may be at risk, and old chat passwords should be cleared. Not finding a match does not completely rule out the use of a different email or reuse of old passwords; critical accounts should be reviewed separately.\u003C\u002Fp>\u003Cp>This record remained verified; the sector and country fields were corrected. In this adjustment, the data fields were left as English canonical classes, the description visible to the user was written in Turkish and original, unverified fields were not included, and the sensitivity flag was used only when supported by the risk context.\u003C\u002Fp>","Phoenix Data Breach (74.8 Thousand Reported Records)","Phoenix Data Breach. 74.8 Thousand reported records were reported. Reported data: Email addresses, IP addresses, Passwords. Review the scope, risks, and…","\u002Fuploads\u002Flogo\u002Fphoenixim_ddns_net.webp",false,{"name":33,"sector":34,"country":35,"website":9,"websiteArchiveUrl":15,"websiteStatus":15,"websiteCheckedAt":19},"Phoenix","Messaging \u002F Legacy Chat Service","Global"]