ai.type aitype.com ai.type data breach: what happened and what to do
In December 2017 the ai.type keyboard app left a MongoDB database publicly open. Have I Been Pwned lists 20,580,060 accounts, with data including names, email addresses, phone numbers, dates of birth and address book contacts.
View all 13,115 breaches- Breach date
- 5 Dec 2017
- Affected
- 20,580,060
- Data exposed
- Address book contacts, Apps installed on devices, Cellular network names, Dates of birth, Device information, Email addresses, Genders, Geographic locations, IMEI numbers, IMSI numbers, IP addresses, Names, Phone numbers, Profile photos, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
ai.type is a virtual keyboard app. In December 2017 researchers at the Kromtech Security Center found that its developer had left a 577GB data set publicly facing in an unsecured MongoDB database. Nobody had to hack in: the data was open to anyone who found it.
Have I Been Pwned lists 20,580,060 accounts. Only the email addresses were provided to HIBP so affected people could check their exposure.
What was exposed
HIBP's list of data types is long: address book contacts, apps installed on devices, cellular network names, dates of birth, device information, email addresses, genders, geographic locations, IMEI and IMSI numbers, IP addresses, names, phone numbers, profile photos and social media profiles. Security coverage put the total at more than 31 million user records. ai.type's CEO told the BBC the data didn't contain sensitive information. Reports said the database was taken offline after the findings were published, and no outside confirmation that criminals downloaded it was reported.
What it means for you
Address book contacts mean the people you know were exposed too, without ever using the app. Phone numbers plus names and birth dates are enough to build a convincing phishing or SIM swap attempt, where a criminal talks your carrier into moving your number.
IMEI and IMSI numbers identify your device and SIM. You can't change them like a password, so the main defence is knowing the attempts to look for.
What to do if you were in it
- 1
Be wary of calls and texts that know your details
Names, phone numbers and dates of birth let scammers sound legitimate. Hang up and call back on a number you look up yourself.
- 2
Add a PIN to your mobile account
Ask your carrier to require a PIN or passcode for SIM changes and number transfers. It makes SIM swap attempts much harder.
- 3
Review the keyboard apps on your phone
Delete keyboards you don't use, and check which permissions the rest have, especially contacts and full access.
- 4
Turn on two-factor authentication
Add 2FA to your email, banking and shopping accounts first. If an old password is still in circulation, a second step stops most takeover attempts.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan. It checks your email and phone number against breach databases and the dark web, and Serus alerts you if they show up in a new one.
Frequently asked
Was I affected by the ai.type breach?
Have I Been Pwned lists 20,580,060 accounts. Search your email on its site, or run a free Serus scan.
What was exposed in the ai.type breach?
HIBP lists data including names, email addresses, phone numbers, dates of birth, address book contacts, IMEI and IMSI numbers and social media profiles.
Was this a hack?
No. Researchers found a MongoDB database left publicly accessible, with no password protecting it.
Should I change my password?
The data HIBP lists doesn't include passwords. Focus on phishing and SIM swap protection instead.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
