E-Pal Data Breach (2022): What Was Exposed & What To Do

E-Pal, a service for connecting users seeking friends on Discord, disclosed a data breach in 2022 that affected approximately 109,000 individuals. The incident involved the exposure of email addresses, usernames, and purchase records tied to roughly one million orders, with the data later appearing on a hacking forum. Such events highlight ongoing risks for platforms that store user account and transaction details.

What happened

In October 2022, E-Pal disclosed that it had suffered a data breach. The compromised dataset contained over 100,000 unique email addresses and usernames linked to approximately one million orders. The material was subsequently distributed on a popular hacking forum.

Public records list the number of people affected as 109,000. No further details on the timing of the intrusion itself, the method of access, or the full scope of files involved have been released.

How a breach like this happens

Incidents involving the exposure of user credentials and transaction records often begin with unauthorised access to a company’s database or application server. Attackers may exploit unpatched software, weak authentication controls, or stolen administrative credentials to reach stored data.

Once inside, an attacker can copy tables containing email addresses, usernames, and purchase histories. The extracted information is then packaged and shared or sold on forums where such material circulates. Organisations frequently learn of the event only after the data appears publicly.

About E-Pal

E-Pal operates as an online platform that helps users locate and connect with others on Discord for social or gaming purposes. Services of this type maintain accounts that include contact information, usernames, and records of any paid features or transactions.

Because the platform handles user identities and payment-related data, a breach can reveal details that users rely on for account recovery and online interactions. The sector’s reliance on email-based authentication makes exposed addresses particularly useful for follow-on attempts to access other services.

What was likely exposed

The breach record names three categories of data: email addresses, usernames, and purchases. These elements were associated with roughly one million orders and more than 100,000 unique email addresses.

Organisations in this sector commonly store additional fields such as account creation dates, IP addresses, and payment metadata. The precise contents of the released dataset beyond the three named categories remain unconfirmed in public reporting.

Why it matters

Exposed email addresses and usernames can be used for targeted phishing or to test password reuse across other sites. Purchase records may reveal spending patterns or service preferences that could support more convincing social-engineering attempts.

For the organisation, the distribution of the data on a public forum increases the likelihood of repeated misuse and can prompt regulatory scrutiny or loss of user trust. Individuals whose information appears in such incidents face ongoing monitoring requirements rather than a single, contained event.

If your data was in this breach

Review any accounts that use the exposed email address and update passwords where reuse is suspected. Enable multi-factor authentication on services that support it and watch for unsolicited messages that reference the platform or past orders.

Readers can run a free exposure scan of their email address against known breach data to determine whether their information has appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.