Indian Social App — 20,000 Users + 19,983 SHA1 Hashes | 2026

M0rk · 05-08-26, 07:45 AM

thx bro

georgejose2000 · (This post was last modified: 05-08-26, 07:53 AM by georgejose2000.)

(04-08-26, 11:26 PM)exfilar Wrote:
Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

Sample Data

{ "name": "Rahul Sharma", "phone": "919876543210", "email": "[email protected]", "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", "dob": "1998-06-15", "deviceId": "a1b2c3d4e5f6g7h8", "deviceName": "Redmi Note 10 Pro", "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu", "bio": "Living life one day at a time", "gender": "male", "createdAt": "2024-03-12T08:30:00.000Z" }

{ "name": "Priya Patel", "phone": "919876543211", "email": "[email protected]", "password": "7c4a8d09ca3762af61e59520943dc26494f8941b", "dob": "1992-11-23", "deviceId": "i9j8k7l6m5n4o3p2", "deviceName": "Samsung Galaxy S21", "fcmToken": "a25haSB0aGlzIHRva2VuIGtl", "bio": "Fashion lover | Travel enthusiast", "gender": "female", "createdAt": "2024-01-05T14:20:00.000Z" }

{ "name": "Amit Kumar", "phone": "919876543212", "email": "[email protected]", "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "dob": "1987-02-10", "deviceId": "z9y8x7w6v5u4t3s2", "deviceName": "OnePlus 9", "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=", "invitationCode": "AMIT2024", "gender": "male", "createdAt": "2023-09-18T11:45:00.000Z" }

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

DOWNLOAD

he bro jhdkjhakjhkla kjdshfkj

sulayeeh · 05-08-26, 08:09 AM

thank you

kavyavjim · 05-08-26, 09:20 AM

Thanks for the share

Archie · 05-08-26, 09:37 AM

Nice to see

commonjoe0202 · 05-08-26, 09:42 AM

Danke dafur!

Fr33d0M · (This post was last modified: 05-08-26, 10:02 AM by Fr33d0M.)

(04-08-26, 11:26 PM)exfilar Wrote:
Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

Sample Data

{ "name": "Rahul Sharma", "phone": "919876543210", "email": "[email protected]", "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", "dob": "1998-06-15", "deviceId": "a1b2c3d4e5f6g7h8", "deviceName": "Redmi Note 10 Pro", "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu", "bio": "Living life one day at a time", "gender": "male", "createdAt": "2024-03-12T08:30:00.000Z" }

{ "name": "Priya Patel", "phone": "919876543211", "email": "[email protected]", "password": "7c4a8d09ca3762af61e59520943dc26494f8941b", "dob": "1992-11-23", "deviceId": "i9j8k7l6m5n4o3p2", "deviceName": "Samsung Galaxy S21", "fcmToken": "a25haSB0aGlzIHRva2VuIGtl", "bio": "Fashion lover | Travel enthusiast", "gender": "female", "createdAt": "2024-01-05T14:20:00.000Z" }

{ "name": "Amit Kumar", "phone": "919876543212", "email": "[email protected]", "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "dob": "1987-02-10", "deviceId": "z9y8x7w6v5u4t3s2", "deviceName": "OnePlus 9", "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=", "invitationCode": "AMIT2024", "gender": "male", "createdAt": "2023-09-18T11:45:00.000Z" }

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

DOWNLOAD

coffee123 · 05-08-26, 02:44 PM

Thanks for share!

fanzhi · 05-08-26, 02:46 PM

Thank you for sharing.

hulk · 05-08-26, 03:11 PM

thanks for the share