Bin Weevils binweevils.com Bin Weevils data breach: what happened and what to do
In September 2014 the children's online game Bin Weevils suffered a breach. Data later given to Have I Been Pwned covered 1,287,073 unique email addresses with genders, ages, IP addresses, usernames and plain text passwords.
View all 13,115 breaches- Breach date
- Sept 2014
- Affected
- 1,287,073
- Data exposed
- Ages, Email addresses, Genders, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Bin Weevils is an online game, popular with children. It suffered a data breach in September 2014. Bin Weevils first said only usernames and passwords had been exposed. A later story on DataBreaches.net indicated a more extensive set of personal attributes was affected, and comments there suggested the data may have come from a later breach. Data matching that pattern was later given to Have I Been Pwned (HIBP) by a security researcher, and HIBP added it in August 2017.
What was exposed
HIBP counts 1,287,073 unique email addresses. The data also holds ages, genders, IP addresses, usernames and passwords. HIBP's description says the passwords were in plain text, meaning anyone with the file could read them directly, with no cracking needed.
What it means for you
Many accounts in a game like this belong to children, who often reuse a password from the game on other accounts or have parents' email addresses attached. An email address combined with a plain text password is the most useful kind of leak for credential stuffing, where attackers try the pair on other sites. Ages and genders add little risk alone, but they help scammers aim messages at a younger audience.
If you or your child had an account in 2014 or earlier, check what that password was reused for.
The company's response
HIBP quotes Bin Weevils' original security update from September 2014, which said usernames and passwords were exposed. HIBP's entry records no later statement from the company.
What to do if you were in it
- 1
Change the password here and anywhere you reused it
Set a new password on the affected account, then change it on every other account where you used the same or a similar one. A password manager makes unique passwords easy. Turn on two-factor login where the site offers it.
- 2
Check any accounts linked to a child's old email address
If a child signed up with a parent's email or their own, look for accounts that share the old game password and change it there.
- 3
Treat unexpected emails that mention the breach with suspicion
Criminals use breach details to make scam emails look real. Don't click links in a message you didn't expect. Go to the company's site by typing the address yourself.
- 4
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases for your email address and phone number, and Serus monitors the dark web and breach databases and alerts you when your details turn up again. Breach data can't be taken back once it has leaked, so the scan tells you what to change, not what to delete.
Frequently asked
Was I affected by the Bin Weevils data breach?
If your email address appears in Have I Been Pwned's Bin Weevils entry, it was in the leaked data. A Serus free scan checks this and other breaches.
What was exposed in the Bin Weevils breach?
Email addresses, usernames, plain text passwords, ages, genders and IP addresses, according to Have I Been Pwned.
Should I change my password after the Bin Weevils breach?
Yes, anywhere you used the game password. It was stored in plain text, so treat it as known.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
