Avast avast.com Avast data breach: what happened and what to do
In May 2014 the Avast anti-virus support forum was hacked and about 423,000 member records were exposed: usernames, email addresses and password hashes. Avast took the forum offline and made members reset their passwords.
View all 13,115 breaches- Breach date
- 26 May 2014
- Affected
- 422,959
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In May 2014, hackers broke into the Avast community forum, the place where customers of the anti-virus company asked for help. Have I Been Pwned (HIBP) lists 422,959 member records from the breach. The forum ran on Simple Machines Forum software hosted separately from Avast's main products.
Security writer Graham Cluley reported that Avast shut the forum down, emailed members who might be affected and moved the forum to a different platform. Avast said its payment, licence and other customer systems were not touched. Members had to reset their passwords before they could use the new forum.
What was exposed
According to HIBP, the data included usernames, email addresses and password hashes. A hash is a scrambled version of a password. Strong hashes are hard to reverse, but weak or common passwords can still be guessed from them, and a reused password is only as safe as the weakest site that stored it.
The practical risk from this kind of data is less about the forum itself and more about what attackers do next. An email address plus a password tried on other sites is how credential stuffing works. A leaked address also makes you a target for phishing that pretends to come from Avast support.
What Avast did
Avast closed the forum quickly, notified members and forced a password reset. Anyone who joined the forum before May 2014 and used the same password elsewhere should treat that password as burned.
What to do if you were in it
- 1
Change your Avast forum password and any reuse of it
If you still have a Avast forum account, set a new password. Then change it on every other account that shares the old one or a close variation. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app on your email, banking and shopping accounts. A leaked password then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Scammers use leaked email addresses to send fake security alerts. Don't click links in unexpected messages. Go to the site yourself instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your details. Serus monitors breach databases and the dark web and alerts you, but it can't remove data from a breach.
Frequently asked
Was I affected by the Avast breach?
If you had an account on the Avast community forum before May 2014, your email address, username and password hash may be in the data. Look up your email on Have I Been Pwned or run a free Serus scan to check.
What was exposed in the Avast breach?
HIBP lists email addresses, passwords (as hashes) and usernames. Avast said its payment and licence systems were not affected.
Should I change my password?
Yes, if you used your forum password anywhere else. Change it on those accounts and use a unique password for each from now on.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
