Appen appen.com Appen data breach: what happened and what to do
In June 2020, AI training data company Appen was breached and almost 5.9 million users' details (5,888,405 accounts) were sold online: names, email addresses and bcrypt-hashed passwords, plus phone numbers, employers and IP addresses on some records.
View all 13,115 breaches- Breach date
- 22 Jun 2020
- Affected
- 5,888,405
- Data exposed
- Email addresses, Employers, IP addresses, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In June 2020, the AI training data company Appen suffered a data breach exposing the details of almost 5.9 million users, which were later sold online. Have I Been Pwned (HIBP) added it in July 2020 and counts 5,888,405 accounts. BleepingComputer reported the leak of data from Appen and other companies.
What was exposed
The data includes names, email addresses and passwords stored as bcrypt hashes. Some records also have phone numbers, employers and IP addresses. Appen works with people who do online tasks to train AI systems, so many affected accounts belong to contract workers.
The employer detail matters. A scammer who knows your name, email and who you work for can write a convincing job offer, payment notice or account alert. Phone numbers add text scams to the mix.
Why old breaches still matter
The breach dates from 2020, but email addresses and phone numbers rarely change, so the data stays useful to scammers. If you reused your Appen password on other sites, those accounts are the ones at risk, not just this one.
What the company said
The account count and data types come from HIBP's entry. BleepingComputer's report is the news source.
What to do if you were in it
- 1
Change your password, and every reuse of it
Change it on Appen first, then on any other account that uses the same or a similar password. A password manager makes unique ones easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where you can, so a leaked password alone isn't enough to get in.
- 3
Treat job and payment messages with suspicion
Don't click links in messages about tasks, payouts or account problems. Go to the site yourself, and never pay to get work.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak. It can't remove data that has already leaked, so the steps above are what protect you.
Frequently asked
Was I affected by the Appen data breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 5,888,405 accounts.
What was exposed?
Email addresses, employers, IP addresses, names, passwords stored as bcrypt hashes and phone numbers.
Should I change my password?
Yes, on Appen and anywhere you reused it, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
