000webhost 000webhost.com 000webhost data breach: what happened and what to do
In about March 2015, free web host 000webhost was breached, exposing almost 15 million accounts: names, email addresses, IP addresses and plain text passwords. The data was traded before the company was told in October. Change any password you reused.
View all 13,115 breaches- Breach date
- Mar 2015
- Affected
- 14,936,670
- Data exposed
- Email addresses, IP addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
000webhost is a free web hosting provider. According to Have I Been Pwned, it suffered a major breach in about March 2015 that exposed almost 15 million customer records. The data was sold and traded before 000webhost was alerted in October 2015.
Security reporting at the time said 000webhost reset all users' passwords at the end of October 2015 and blamed an intruder who used a flaw in an old PHP version to upload files and get into its systems.
What was exposed
Have I Been Pwned lists names, email addresses, IP addresses and passwords. The passwords were stored in plain text, so they were readable as they stood.
Plain text passwords are the main danger. Criminals try them on other accounts, since many people reuse passwords. Names and emails also help phishing look personal, for example a message claiming to be from a hosting company about your website.
What the company did
The company reset user passwords after the breach became public. If you had an account in 2015 and never changed that password elsewhere, treat it as known to criminals.
What to do if you were in it
- 1
Change reused passwords
If your 000webhost password was used on any other account, change it there now. Give each account its own password.
- 2
Turn on two-factor login
Enable two-factor authentication on your email, hosting and domain accounts so a leaked password alone can't get in.
- 3
Watch for hosting and website phishing
Expect emails about expiring domains, suspended sites or account verification. Open your hosting dashboard directly instead of using the link.
- 4
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases for your email address and phone number, and alerts you if they show up. It can't take data out of a breach, but it tells you what to change.
Frequently asked
Was I affected by the 000webhost breach?
If you had a 000webhost account around 2015, possibly. Check your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the 000webhost breach?
Names, email addresses, IP addresses and plain text passwords.
How many accounts were affected?
Have I Been Pwned counts 14,936,670 accounts.
Should I change my password?
Yes, if you reused your 000webhost password anywhere. Change it on those sites and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
