Avito avito.ma Avito data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In November 2022, the Moroccan e-commerce service Avito was breached. Have I Been Pwned lists 2,721,835 customers, with names, email addresses, phone numbers, IP addresses and geographic locations exposed. It was added to the site in November 2023.
View all 13,118 breaches- Breach date
- 18 Nov 2022
- Affected
- 2,721,835
- Data exposed
- Email addresses, Geographic locations, IP addresses, Names, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Avito is a Moroccan online marketplace. In November 2022 it suffered a data breach. Have I Been Pwned (HIBP) lists 2,721,835 accounts and added them on 14 November 2023. HIBP describes the exposed data as the personal information of 2.7 million customers.
Sources checked: haveibeenpwned.com, ledesk.ma, consumer.ftc.gov
Last verified against the official page:
What was exposed
Names, email addresses, phone numbers, IP addresses and geographic locations. HIBP does not list passwords for this breach.
What it means for you
A name, a phone number and a location together are what scammers use to make a call or text look genuine, for example a fake buyer or delivery message that mentions your city. Expect smishing (scam texts) and phone calls rather than password attacks, since HIBP lists no passwords for this breach. Smishing is phishing by text message, and the message often claims to be about a delivery, a payment or an account problem.
The company's response
Avito explained the incident to the Moroccan press in December 2022, as reported by Le Desk, which is the source HIBP links to.
What to do if you were in it
- 1
Expect scam messages
With your name, phone number and location out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 2
Don't trust links or payment requests from strangers
Don't click links in texts or messages, even ones that mention a real listing. Open the company's app or site yourself, and don't pay outside the platform.
- 3
Tell your phone provider and report scams
Block and report scam texts to your mobile provider. In the US, the FTC takes reports at ReportFraud; elsewhere use your national fraud reporting service.
- 4
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the Avito breach?
Search your email or phone number on Have I Been Pwned. If Avito shows up, you were among the 2,721,835 accounts listed.
What was exposed in the Avito breach?
Names, email addresses, phone numbers, IP addresses and geographic locations, per HIBP.
Should I change my password?
HIBP doesn't list passwords for this breach, but changing a reused password is still sensible if you used it elsewhere.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
