Indian Social App — 20,000 Users + 19,983 SHA1 Hashes | 2026
by exfilar - Tuesday August 4, 2026 at 11:26 PM
DarkForums Members
Members
Posts: 274
Threads: 0
Joined: May 2025
Reputation: -2

#21
05-08-26, 03:18 PM
Pepeplant
Reply
Banned

Posts: 17
Threads: 2
Joined: Jun 2023

#22
05-08-26, 03:36 PM
(04-08-26, 11:26 PM)exfilar Wrote:
Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)


Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen


Sample Data

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }


Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt


What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft


What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.


DOWNLOAD

Ban reason: suspect scam (Permanent)
Reply
DarkForums Members
Members
Posts: 2
Threads: 0
Joined: Aug 2026
Reputation: 0

#23
05-08-26, 03:38 PM
(04-08-26, 11:26 PM)exfilar Wrote:
Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)


Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen


Sample Data

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }


Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt


What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft


What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.


DOWNLOAD



Attached Files Thumbnail(s)
   
Reply
DarkForums Members
Members
Posts: 84
Threads: 0
Joined: Apr 2025
Reputation: 0

#24
05-08-26, 03:41 PM
thanks for sharing
Reply
DarkForums Members
Members
Posts: 497
Threads: 0
Joined: Dec 2025
Reputation: -1

#25
05-08-26, 05:39 PM
nice man
Reply
DarkForums Members
Members
Posts: 49
Threads: 9
Joined: Sep 2023
Reputation: 1

#26
05-08-26, 06:56 PM
thanks for this leak , seems imp
Reply
DarkForums Members
Members
Posts: 144
Threads: 0
Joined: Jan 2026
Reputation: 0

#27
05-08-26, 08:00 PM
Thank you for sharing
Reply
DarkForums Members
Members
Posts: 26
Threads: 0
Joined: Sep 2025
Reputation: 0

#28
06-08-26, 02:45 AM
Lets seee
Reply
DarkForums Members
Members
Posts: 57
Threads: 0
Joined: Apr 2026
Reputation: 0

#29
06-08-26, 02:54 AM
(04-08-26, 11:26 PM)exfilar Wrote:
Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)


Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen


Sample Data

{   "name": "Rahul Sharma",   "phone": "919876543210",   "email": "[email protected]",   "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",   "dob": "1998-06-15",   "deviceId": "a1b2c3d4e5f6g7h8",   "deviceName": "Redmi Note 10 Pro",   "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu",   "bio": "Living life one day at a time",   "gender": "male",   "createdAt": "2024-03-12T08:30:00.000Z" }

{   "name": "Priya Patel",   "phone": "919876543211",   "email": "[email protected]",   "password": "7c4a8d09ca3762af61e59520943dc26494f8941b",   "dob": "1992-11-23",   "deviceId": "i9j8k7l6m5n4o3p2",   "deviceName": "Samsung Galaxy S21",   "fcmToken": "a25haSB0aGlzIHRva2VuIGtl",   "bio": "Fashion lover | Travel enthusiast",   "gender": "female",   "createdAt": "2024-01-05T14:20:00.000Z" }

{   "name": "Amit Kumar",   "phone": "919876543212",   "email": "[email protected]",   "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709",   "dob": "1987-02-10",   "deviceId": "z9y8x7w6v5u4t3s2",   "deviceName": "OnePlus 9",   "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=",   "invitationCode": "AMIT2024",   "gender": "male",   "createdAt": "2023-09-18T11:45:00.000Z" }


Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt


What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft


What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.


DOWNLOAD

Reply
DarkForums Members
Members
Posts: 29
Threads: 0
Joined: Jul 2026
Reputation: 0

#30
06-08-26, 07:44 AM
that's nice
Reply


Forum Jump:


 Users browsing this thread: 1 Guest(s)