AlpineReplay traceup.com AlpineReplay data breach: what happened and what to do
In 2019 the snow sports tracking app AlpineReplay suffered a data breach. Have I Been Pwned lists 898,681 accounts, with names, usernames, emails, dates of birth, genders, weights and password hashes exposed.
View all 13,115 breaches- Breach date
- 27 Aug 2019
- Affected
- 898,681
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Passwords, Physical attributes, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
AlpineReplay was a snow sports tracking app, later rolled into a service called Trace. A breach of its user data dates to 27 August 2019, and Have I Been Pwned (HIBP) added it on 17 October 2024.
What happened
HIBP reports that the breach exposed about 900,000 unique email addresses. The details here come from HIBP's entry.
What was exposed
HIBP lists 898,681 accounts with dates of birth, email addresses, genders, names, passwords, physical attributes and usernames. The passwords were stored as either unsalted MD5 or bcrypt hashes, and the physical attribute was weight.
Unsalted MD5 hashes are fast to crack, so a weak or reused password from the older accounts should be treated as known. Names, birth dates and email addresses together are also enough to make phishing messages look personal, for example a fake Trace account notice that quotes your username.
What to do
Change the password on any account that shared it with AlpineReplay or Trace, even if you stopped using the app years ago. Turn on two-factor login on your email first, since that is the account attackers use to reset others.
What to do if you were in it
- 1
Change your password and any reuse of it
Change it on the affected service and on every other account that uses the same or a similar password. A password manager makes unique passwords easy. Turn on two-factor login where it's offered.
- 2
Secure your email account first
Your email can reset every other account. Use a unique password and two-factor login there before anything else.
- 3
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls as suspect, especially ones that name the company or offer help with the breach. Don't click links in them; go to the company's site yourself.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the AlpineReplay breach?
Look up your email on Have I Been Pwned, or run a free Serus scan. HIBP lists 898,681 accounts.
What was exposed?
Names, usernames, email addresses, genders, dates of birth, weights and password hashes.
Should I change my password?
Yes, anywhere you used the same one. Some passwords were stored as unsalted MD5, which is quick to crack.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
