Animoto animoto.com Animoto data breach: what happened and what to do
In July 2018, video maker Animoto had a data breach that exposed about 22 million accounts. Names, email addresses, dates of birth, locations and salted password hashes were taken. Animoto said payment card data was stored separately.
View all 13,115 breaches- Breach date
- 10 Jul 2018
- Affected
- 22,437,749
- Data exposed
- Dates of birth, Email addresses, Geographic locations, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Animoto, a cloud-based video making service, first noticed unusual activity on its systems on July 10, 2018. On August 6, 2018, it confirmed the activity was unauthorized. It notified the California Attorney General and customers on August 16, 2018, and told TechCrunch that all of its roughly 22 million users would be contacted.
Have I Been Pwned lists 22,437,749 affected accounts. The exposed data includes names, email addresses, dates of birth, geographic locations and salted password hashes. A salted hash is a scrambled version of a password, which is harder to crack than a plain one but not impossible when the password is weak. Animoto said payment card data was kept separately and wasn't accessed. It also said it reset employee passwords and cut back staff access to critical systems.
A name, an email address and a date of birth together are enough to make a phishing message look personal, and a date of birth can help someone pass weak identity checks. If you used the same password on Animoto and elsewhere, change it everywhere, because cracked hashes get tried against other sites.
What to do if you were in it
- 1
Change your Animoto password and any copy of it
If you reuse the Animoto password anywhere, change it there too, starting with email and banking. Use a unique password for each account and turn on two-factor authentication where it's offered.
- 2
Treat unexpected emails and texts with suspicion
Criminals use breach details to make scam messages sound real. If a message mentions the breach or asks you to log in, click a link or share a code, go to the company's site yourself instead.
- 3
Be careful with your date of birth
A date of birth can't be changed, so watch for it being used to verify someone as you. Ignore calls or emails that quote it to seem trustworthy.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks for your email and phone number in breach databases and the dark web and tells you what to do about each hit. Serus can't pull breach data back, but it alerts you when your details turn up.
Frequently asked
Was I affected by the Animoto breach?
Animoto said it would notify all of its roughly 22 million users. You can also search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Animoto breach?
Names, email addresses, dates of birth, geographic locations and salted password hashes, according to Have I Been Pwned. Animoto said payment card data was stored separately and wasn't accessed.
Should I change my password?
Yes, if you ever had an Animoto account. Change it on Animoto and on any site where you reused it, and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
