Bitly bitly.com Bitly data breach: what happened and what to do
Bitly announced a breach in May 2014. Have I Been Pwned lists 9,313,136 accounts with email addresses, usernames and hashed passwords, most using SHA1 and a small number using bcrypt.
View all 13,115 breaches- Breach date
- 8 May 2014
- Affected
- 9,313,136
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Bitly, the link shortening service, told its users in May 2014 that their account credentials might have been exposed. Have I Been Pwned lists 9,313,136 accounts in the breach, with email addresses, usernames and hashed passwords. Most of the hashes used SHA1 and a small number used bcrypt.
What Bitly said
Bitly's notice said it had reason to believe account credentials were compromised. Its CEO wrote that email addresses, encrypted passwords, API keys and OAuth tokens were involved. News coverage at the time reported that Bitly found no sign of unauthorized logins, and that it didn't explain how it concluded the breach had happened.
As a precaution, Bitly disconnected the Facebook and Twitter links from all accounts. Users could reconnect them at their next login. It also told people to change their password and reset their API key and OAuth token, which you can do under Settings and then the Advanced tab.
Why API keys and tokens matter
A password is only one way into an account. An API key or OAuth token lets other apps act as you without a password. If one leaks, changing your password doesn't cancel it. That's why Bitly asked for the reset as well.
What it means for you
Your email address and username may sit in a list that criminals use for credential stuffing, trying one site's password on many others. SHA1 is a fast hash that's easy to crack for weak passwords, so assume a simple password is no longer secret.
Bitly links you shared in the past still work, so a leak of your account is less about those links and more about the reused password.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Set a new, unique password on Bitly. If you used the same password on other accounts, change those too. A password manager makes unique passwords painless.
- 2
Reset your Bitly API key and tokens
In Bitly's settings, generate a new API key and revoke old connected apps. Reconnect only the ones you still use.
- 3
Turn on two-factor authentication
Add 2FA to your email, banking and shopping accounts first. If an old password is still in circulation, a second step stops most takeover attempts.
- 4
Check whether your email is in this and other breaches
Run a free Serus scan. It checks your email and phone number against breach databases and the dark web, and Serus alerts you if they show up in a new one.
Frequently asked
Was I affected by the Bitly breach?
Have I Been Pwned lists 9,313,136 accounts. Search your email on its site, or run a free Serus scan.
What was exposed in the Bitly breach?
HIBP lists email addresses, usernames and hashed passwords. Bitly's notice also mentioned API keys and OAuth tokens.
Should I change my password?
Yes, if you had a Bitly account in 2014 and used that password elsewhere. Reset your API key too.
Did Bitly say anyone logged in without permission?
Press coverage at the time reported that Bitly saw no sign of unauthorized access, but it still asked everyone to reset credentials.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
