Indian Social App — 20,000 Users + 19,983 SHA1 Hashes | 2026

[ottomanturk27]

Indian Social App — 20,000 Users + 19,983 SHA1 Hashes

Drop #2 from FireMass

About the leak

Firebase Firestore wide open on an Indian social networking app. Full user database exposed. Names, phone numbers, DOBs, device IDs, FCM push tokens — the works. Every single field readable by anyone who knows how to type a URL.

Date: 08-2026
Format: JSON
Users: 20,000
Passwords: 19,983 SHA1 (unsalted — hashcat mode 100)
Phones: 19,983 (+91 India)


Fields exposed

name · phone (+91) · email · dob · password (SHA1) · deviceId · deviceName · fcmToken · referralCode · invitationCode · bio · profilePic · gender · createdAt · lastSeen


Sample Data

Code:
{ "name": "Rahul Sharma", "phone": "919876543210", "email": "rahul.sharma@gmail.com", "password": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", "dob": "1998-06-15", "deviceId": "a1b2c3d4e5f6g7h8", "deviceName": "Redmi Note 10 Pro", "fcmToken": "dGhpcyBpcyBhIGZha2UgRkNNIHRva2Vu", "bio": "Living life one day at a time", "gender": "male", "createdAt": "2024-03-12T08:30:00.000Z" }

Code:
{ "name": "Priya Patel", "phone": "919876543211", "email": "priya.patel92@yahoo.com", "password": "7c4a8d09ca3762af61e59520943dc26494f8941b", "dob": "1992-11-23", "deviceId": "i9j8k7l6m5n4o3p2", "deviceName": "Samsung Galaxy S21", "fcmToken": "a25haSB0aGlzIHRva2VuIGtl", "bio": "Fashion lover | Travel enthusiast", "gender": "female", "createdAt": "2024-01-05T14:20:00.000Z" }

Code:
{ "name": "Amit Kumar", "phone": "919876543212", "email": "amit.kumar@outlook.com", "password": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "dob": "1987-02-10", "deviceId": "z9y8x7w6v5u4t3s2", "deviceName": "OnePlus 9", "fcmToken": "ZG9udCB0cnkgdG8gZGVjb2RlIHRoaXM=", "invitationCode": "AMIT2024", "gender": "male", "createdAt": "2023-09-18T11:45:00.000Z" }


Hashcat Info

SHA1 hashes are unsalted — ready for hashcat mode 100:

Code:
hashcat -m 100 -a 0 hashes.txt rockyou.txt


What's included

· 19,983 real Indian phone numbers (+91 prefix) — ready for SMS/SIM swap ops
· 19,983 SHA1 hashes — unsalted, hashcat mode 100
· FCM push tokens — push notification hijacking potential
· Device IDs — device fingerprinting
· DOBs, names, bios — full profile for social engineering or identity theft




DOWNLOAD
Hidden Content

Gofile - Cloud Storage Made Simple

Secure, fast and free cloud storage solution. Upload and share files instantly.

gofile.io