Avvo avvo.com Avvo data breach: what happened and what to do
Around December 2019, data from the lawyer directory Avvo was published on a hacking forum and used in an extortion scam. It held 4,101,101 unique email addresses and SHA-1 hashes that most likely represent passwords.
View all 13,115 breaches- Breach date
- 17 Dec 2019
- Affected
- 4,101,101
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Avvo is a US directory where people look up and rate lawyers. In approximately December 2019, an alleged data breach of Avvo was published on an online hacking forum and used in an extortion scam, according to Have I Been Pwned. HIBP notes the exposure may date back earlier than that.
The data contained 4,101,101 unique email addresses alongside SHA-1 hashes, most likely representing user passwords. HIBP tried to reach Avvo several times over a week without success, and verified the data's authenticity with Avvo users who are also HIBP subscribers. Troy Hunt, who runs HIBP, described the disclosure attempts in a blog post. HIBP added the breach in April 2022.
What was exposed
Email addresses and passwords stored as SHA-1 hashes. SHA-1 is a fast hash that was never meant for passwords, so common passwords can be recovered from it quickly.
What it means for you
An exposed email and a crackable password is the classic setup for credential stuffing: criminals try the same pair on email, shopping and banking sites. Anyone who used an Avvo login elsewhere is at risk. The email address also puts you on phishing lists.
The leak can't be pulled back. Serus monitors breach databases and the dark web for your email and alerts you when it appears in a new leak.
What to do if you were in it
- 1
Change your Avvo password and every reuse of it
Start with your email account, then banking and shopping. Use a unique password for each from a password manager.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email and financial accounts so a stolen password isn't enough.
- 3
Ignore extortion emails
The data was used in an extortion scam. Messages that threaten to expose you unless you pay are scams. Don't reply or pay.
- 4
Expect phishing
Your email address is on lists that scammers use. Open sites yourself rather than clicking links in unexpected messages.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see every breach that includes you.
Frequently asked
Was I affected by the Avvo breach?
Search your email on Have I Been Pwned, which lists 4,101,101 email addresses for this breach, or run a free Serus scan.
What was exposed?
Email addresses and SHA-1 hashes that most likely represent passwords.
Should I change my password?
Yes, on Avvo and anywhere you reused the same password. SHA-1 hashes are quick to crack.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
