Indian Social App — 20,000 Users + 19,983 SHA1 Hashes | 2026

~~Quidprocow~~ · (This post was last modified: 09-08-26, 08:27 AM by Quidprocow.)

(04-08-26, 11:26 PM)exfilar Wrote:
Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

Sample Data

{ "name": "Rahul Sharma", "phone": "919876543210", "email": "[email protected]", "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", "dob": "1998-06-15", "deviceId": "a1b2c3d4e5f6g7h8", "deviceName": "Redmi Note 10 Pro", "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu", "bio": "Living life one day at a time", "gender": "male", "createdAt": "2024-03-12T08:30:00.000Z" }

{ "name": "Priya Patel", "phone": "919876543211", "email": "[email protected]", "password": "7c4a8d09ca3762af61e59520943dc26494f8941b", "dob": "1992-11-23", "deviceId": "i9j8k7l6m5n4o3p2", "deviceName": "Samsung Galaxy S21", "fcmToken": "a25haSB0aGlzIHRva2VuIGtl", "bio": "Fashion lover | Travel enthusiast", "gender": "female", "createdAt": "2024-01-05T14:20:00.000Z" }

{ "name": "Amit Kumar", "phone": "919876543212", "email": "[email protected]", "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "dob": "1987-02-10", "deviceId": "z9y8x7w6v5u4t3s2", "deviceName": "OnePlus 9", "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=", "invitationCode": "AMIT2024", "gender": "male", "createdAt": "2023-09-18T11:45:00.000Z" }

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

DOWNLOAD

Good done

tariqmuhammadmir · 10-08-26, 11:37 AM

Let me Check this data broo

rks_0 · 10-08-26, 01:25 PM

(04-08-26, 11:26 PM)exfilar Wrote:
Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

Sample Data

{ "name": "Rahul Sharma", "phone": "919876543210", "email": "[email protected]", "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", "dob": "1998-06-15", "deviceId": "a1b2c3d4e5f6g7h8", "deviceName": "Redmi Note 10 Pro", "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu", "bio": "Living life one day at a time", "gender": "male", "createdAt": "2024-03-12T08:30:00.000Z" }

{ "name": "Priya Patel", "phone": "919876543211", "email": "[email protected]", "password": "7c4a8d09ca3762af61e59520943dc26494f8941b", "dob": "1992-11-23", "deviceId": "i9j8k7l6m5n4o3p2", "deviceName": "Samsung Galaxy S21", "fcmToken": "a25haSB0aGlzIHRva2VuIGtl", "bio": "Fashion lover | Travel enthusiast", "gender": "female", "createdAt": "2024-01-05T14:20:00.000Z" }

{ "name": "Amit Kumar", "phone": "919876543212", "email": "[email protected]", "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "dob": "1987-02-10", "deviceId": "z9y8x7w6v5u4t3s2", "deviceName": "OnePlus 9", "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=", "invitationCode": "AMIT2024", "gender": "male", "createdAt": "2023-09-18T11:45:00.000Z" }

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

thanks
What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

DOWNLOAD

moniki4556 · 10-08-26, 01:42 PM

thanks bro

halohalomr · 10-08-26, 02:06 PM

still alive?

jackjones · 11-08-26, 01:09 PM

thanks

LukeWorm16 · 11-08-26, 04:08 PM

Thanks

devildebdas · 11-08-26, 09:07 PM

(04-08-26, 11:26 PM)exfilar Wrote:
Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

jfjgfgjfAbout the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

Sample Data

{ "name": "Rahul Sharma", "phone": "919876543210", "email": "[email protected]", "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", "dob": "1998-06-15", "deviceId": "a1b2c3d4e5f6g7h8", "deviceName": "Redmi Note 10 Pro", "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu", "bio": "Living life one day at a time", "gender": "male", "createdAt": "2024-03-12T08:30:00.000Z" } bfgjfjjjf

{ "name": "Priya Patel", "phone": "919876543211", "email": "[email protected]", "password": "7c4a8d09ca3762af61e59520943dc26494f8941b", "dob": "1992-11-23", "deviceId": "i9j8k7l6m5n4o3p2", "deviceName": "Samsung Galaxy S21", "fcmToken": "a25haSB0aGlzIHRva2VuIGtl", "bio": "Fashion lover | Travel enthusiast", "gender": "female", "createdAt": "2024-01-05T14:20:00.000Z" }

{ "name": "Amit Kumar", "phone": "919876543212", "email": "[email protected]", "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "dob": "1987-02-10", "deviceId": "z9y8x7w6v5u4t3s2", "deviceName": "OnePlus 9", "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=", "invitationCode": "AMIT2024", "gender": "male", "createdAt": "2023-09-18T11:45:00.000Z" }

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

DOWNLOAD

d4rkf0rums · (This post was last modified: 12-08-26, 05:01 PM by d4rkf0rums.)

(04-08-26, 11:26 PM)exfilar Wrote:
Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)

Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen

Sample Data

{ "name": "Rahul Sharma", "phone": "919876543210", "email": "[email protected]", "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", "dob": "1998-06-15", "deviceId": "a1b2c3d4e5f6g7h8", "deviceName": "Redmi Note 10 Pro", "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu", "bio": "Living life one day at a time", "gender": "male", "createdAt": "2024-03-12T08:30:00.000Z" }

{ "name": "Priya Patel", "phone": "919876543211", "email": "[email protected]", "password": "7c4a8d09ca3762af61e59520943dc26494f8941b", "dob": "1992-11-23", "deviceId": "i9j8k7l6m5n4o3p2", "deviceName": "Samsung Galaxy S21", "fcmToken": "a25haSB0aGlzIHRva2VuIGtl", "bio": "Fashion lover | Travel enthusiast", "gender": "female", "createdAt": "2024-01-05T14:20:00.000Z" }

{ "name": "Amit Kumar", "phone": "919876543212", "email": "[email protected]", "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "dob": "1987-02-10", "deviceId": "z9y8x7w6v5u4t3s2", "deviceName": "OnePlus 9", "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=", "invitationCode": "AMIT2024", "gender": "male", "createdAt": "2023-09-18T11:45:00.000Z" }

Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

hashcat -m 100 -a 0 hashes.txt rockyou.txt

What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft

What this is

This is drop #2 of ~25 from the FireMass pipeline. The scanner found 40+ open Firebase projects across the Internet. More drops coming as I sort through the dumps.

Final word

Not selling the data. Tool test, sharing results. This is what happens when developers assume Firebase is secure by default.

DOWNLOAD

everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion

leakER313 · 12-08-26, 07:49 PM

nice one brother