8tracks 8tracks.com 8tracks data breach: what happened and what to do
In June 2017, the playlist service 8tracks was breached, exposing about 18 million accounts. Email addresses and salted SHA-1 password hashes were included. HIBP added the data in February 2018.
View all 13,115 breaches- Breach date
- 27 Jun 2017
- Affected
- 17,979,961
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
8tracks, an online playlist service, was breached in June 2017. About 18 million accounts were affected, according to Have I Been Pwned (HIBP). The company said the way in was an employee's GitHub account that wasn't protected with two-factor authentication.
What happened
8tracks published a password security alert on 27 June 2017. It said the attack started with that GitHub account. Dark Reading reported the company noticed after GitHub flagged an unauthorized attempt to change the employee's password. 8tracks said production servers weren't reached, but the intruders got to a backup of database tables that held user data.
HIBP added the data on 16 February 2018. It first received about 8 million unique email addresses from a security researcher, and a complete set of 18 million records was provided later.
What was exposed
The data includes email addresses and passwords. For people who signed up with email rather than Google or Facebook, the passwords were salted SHA-1 hashes. A hash is a scrambled version of a password, but SHA-1 is old and weak, so many hashes can be cracked.
With your email address, criminals can send phishing messages that mention music or streaming. If you reused the password elsewhere, they can try it on other sites, which is called credential stuffing.
The company's response
8tracks told users about the breach and recommended changing passwords, including on other sites where the same one was used.
What to do if you were in it
- 1
Change the password here and anywhere you reused it
If you used this password on another site, change it there first. Use a unique password for every account, ideally from a password manager.
- 2
Turn on two-factor authentication
Add an authenticator app or security key to your email, banking and shopping accounts so a stolen password alone isn't enough.
- 3
Expect phishing to this email address
Treat messages that mention 8tracks, playlists or account problems with suspicion, and don't click links in them. Go to the site directly.
- 4
Run a free breach check
Check whether your email or phone number shows up in this and other breaches with a free Serus scan.
Frequently asked
Was I affected by the 8tracks breach?
If you had an 8tracks account in June 2017, probably. HIBP lets you search your email address, and a free Serus scan checks it against this and other breaches.
What was exposed in the 8tracks breach?
Email addresses and passwords. For accounts created with email, the passwords were salted SHA-1 hashes.
Should I change my password?
Yes, if you used the same password anywhere else. Change it there and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
