On April 15, 2024, the streaming service MovieBoxPro appeared in a 6.0 million record breach listing on Have I Been Pwned. The exposure stemmed from a vulnerable API that allowed mass scraping of email addresses and usernames, affecting anyone who had created an account on the platform.
Named in this incident?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch MovieBoxPro
Get alerted the next time MovieBoxPro files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about MovieBoxPro’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Primary Disclosure Details
The Have I Been Pwned entry states that the breach occurred in April 2024 when attackers scraped more than 6 million records from an unprotected API endpoint. The service, which operated in a legal gray area for streaming copyrighted material, provided no public contact details for breach notifications. The listing confirms that only email addresses and usernames were exposed in the dataset. The disclosure indicates the vulnerability was eventually closed after the mass enumeration took place, but the extracted data had already circulated. No evidence of encryption or access controls on the API was mentioned, and the exact method of initial discovery remains unstated in the primary record.
Why This Matters for You and Your Family
If you or anyone in your household ever signed up for MovieBoxPro, your email address and chosen username are now publicly available to anyone who downloads the dataset. These two pieces of information are frequently the starting point for credential-stuffing attacks, phishing campaigns, and doxxing attempts. Because many people reuse the same email-password combination across services, a leak that seems limited on paper can quickly escalate. Children and teenagers who used family email addresses to register for streaming apps are equally exposed, turning a single entertainment account into a gateway that links back to your real-world identity.
Doxxing and Identity-Chain Risks
Usernames are especially dangerous in this breach. Once attackers possess both an email and a username, they can correlate them across gaming platforms, social media, forums, and data-broker profiles. This creates an identity chain that reveals your full name, location, phone number, and family relationships far faster than most people expect. Credential leaks of this nature routinely cascade into account takeovers on gaming services, where children’s profiles become targets for harassment or further extortion. The combination of email and username effectively hands threat actors a ready-made map for linking your digital handles to your household.