Ancestry ancestry.com Ancestry data breach: what happened and what to do
A file with 297,806 RootsWeb (an Ancestry service) email addresses and plain text passwords leaked after a November 2015 breach. It wasn't found until late 2017. Only emails and passwords were exposed, no payment details.
View all 13,115 breaches- Breach date
- 7 Nov 2015
- Made public
- 23 Dec 2017
- Affected
- 297,806
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In December 2017, Ancestry told customers that a file containing the email addresses and passwords of RootsWeb users had been found on a server outside its control. RootsWeb is a free genealogy community that Ancestry owns, and it ran on separate infrastructure from the main Ancestry site.
What happened
According to Have I Been Pwned, RootsWeb suffered a data breach in November 2015. Nobody noticed for two years. The file turned up in late 2017, and it held 297,806 email addresses with passwords stored as plain text, meaning anyone holding the file could read them with no cracking at all.
Ancestry published a security notice on 23 December 2017 and took RootsWeb offline while it rebuilt parts of the system. Its figures, as reported at the time, were that about 55,000 of the exposed logins were used on both RootsWeb and an Ancestry site, mostly from free trial or unused accounts, and that about 7,000 of the email and password pairs matched active Ancestry customers. Ancestry said it forced a password reset for those customers.
What was exposed
Two things: email addresses and passwords. Ancestry said RootsWeb doesn't hold sensitive details such as credit card or Social Security numbers, and nothing in the exposed file points the other way.
That still matters, because of how people reuse passwords. A plain text password next to an email address is a ready-made login. Criminals try the same pair on email providers, shopping sites and banks, an attack called credential stuffing. If you used your RootsWeb password anywhere else, that other account was the real risk, and it may still be if you never changed it.
Your email address also ends up on lists used for phishing. A message that mentions genealogy, family trees or DNA tests is more convincing when it lands in the inbox of someone who really did use those services.
What Ancestry did
Ancestry contacted affected customers directly, required new passwords for the ones whose logins matched active accounts, and kept RootsWeb offline until it finished improving the infrastructure. The notice is still the best primary source for what the company said at the time.
Why an old breach still counts
This one is from 2015, so the practical danger depends on what you did next. If you changed your password in 2017 and never reused it, you're probably fine. If you still use a password from that era anywhere, change it today. Old credentials get recycled in new attack lists for years.
If you want to see which other breaches your email address appears in, that's quick to check. Most people find more than one, and the older entries tell you which passwords to retire.
What to do if you were in it
- 1
Change any password you used on RootsWeb or Ancestry
Start with the Ancestry account if you still have one, then any other account that shares the password. Use a different, long password for each.
- 2
Use a password manager
A manager generates and stores a unique password per site, which ends the reuse problem that makes a breach like this dangerous.
- 3
Turn on two-factor authentication
Add an authenticator app or passkey to your email first, then your bank and shopping accounts. A stolen password alone then can't open them.
- 4
Watch for phishing about family history
Treat unexpected messages about DNA matches, family trees or account problems as suspect. Go to the site by typing its address, not by clicking the message.
- 5
Check which other breaches include your email
Run a free Serus scan to see whether your email address shows up in this and other breaches.
Frequently asked
Was I affected by the Ancestry breach?
If you had a RootsWeb account in 2015, possibly. Have I Been Pwned lists 297,806 exposed email addresses, and you can search yours there or run a free Serus scan.
What was exposed in the Ancestry breach?
Email addresses and passwords. The passwords were stored as plain text. Ancestry said RootsWeb doesn't hold credit card or Social Security numbers.
Should I change my Ancestry password?
Yes, if you haven't changed it since 2017 or if you reused it anywhere. Change the reused copies too, not only the Ancestry one.
When did the Ancestry breach happen?
The breach itself was in November 2015. It wasn't discovered until late 2017, and Ancestry announced it in December 2017.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
