AnimeLeague animeleague.net AnimeLeague data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In July 2024 AnimeLeague disclosed a data breach. Have I Been Pwned lists 192,134 accounts with email addresses, usernames, dates of birth, phone numbers, private messages, purchases, IP addresses and hashed passwords.
View all 13,118 breaches- Breach date
- 4 Jul 2024
- Affected
- 192,134
- Data exposed
- Dates of birth, Email addresses, IP addresses, Passwords, Phone numbers, Private messages, Purchases, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
AnimeLeague runs an anime community with a forum and event registration. In July 2024 it disclosed a data breach. Have I Been Pwned says the data was posted for sale on a hacking forum and covered two databases: event registration records and a dump of the phpBB bulletin board. It lists 192,134 accounts.
Sources checked: haveibeenpwned.com, animeleague.net, consumer.ftc.gov
Last verified against the official page:
What was exposed
The data included email addresses, usernames, dates of birth, phone numbers, IP addresses, purchases and private messages. Passwords were stored as hashes in several formats, including SHA-1, salted MD5 and bcrypt. SHA-1 and MD5 are older and weaker than bcrypt.
What that lets criminals do
Private messages and purchases make phishing more personal. Weak passwords stored with old hash formats are the ones most likely to be cracked and tried on other accounts. A date of birth plus an email and phone number helps someone impersonate you.
The company's response
AnimeLeague disclosed the incident itself on its forum, which Have I Been Pwned links to.
What to do
Change the password first, then expect messages that use what you've said or bought in the community.
What to do if you were in it
- 1
Change your AnimeLeague password, and any you reused
Passwords were stored in several hash formats, including older SHA-1 and salted MD5. Change the password on your AnimeLeague account and on every other account where you used the same one. Use a different password for each site and turn on two-factor authentication wherever it's offered.
- 2
Expect phishing that mentions the breach
Emails, texts and calls that quote your name or a real purchase look more convincing. Don't click links or open attachments in unexpected messages; go to the company's site yourself instead. The FTC explains how to spot phishing.
- 3
Treat your old private messages as exposed
Private messages were in the data. If you shared an address, a phone number or login details in a message, assume someone else can read it, and change anything that still applies.
- 4
Check whether your email or phone is in this and other breaches
Search your email address on Have I Been Pwned. A free Serus scan also checks breach databases and the dark web and alerts you when your details appear. Serus can't remove data from a breach, so the steps above matter most.
Frequently asked
Was I affected by the AnimeLeague breach?
Have I Been Pwned lists 192,134 accounts. Search your email address there to see whether yours is included.
What was exposed in the AnimeLeague breach?
Email addresses, usernames, dates of birth, phone numbers, IP addresses, purchases, private messages and hashed passwords.
Should I change my AnimeLeague password?
Yes, if you had an account. Change it, and change it on any other site where you used the same password. Turn on two-factor authentication where you can.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
