CashCrate cashcrate.com CashCrate data breach: what happened and what to do
CashCrate, a cash-for-surveys site, was breached in November 2016, exposing about 6.8 million accounts. Names, physical addresses, email addresses and passwords were included. The breach became public in June 2017.
View all 13,115 breaches- Breach date
- 17 Nov 2016
- Affected
- 6,844,490
- Data exposed
- Email addresses, Names, Passwords, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
CashCrate, a cash-for-surveys website, was breached in November 2016. Have I Been Pwned (HIBP) lists 6,844,490 affected accounts. News of the breach broke in June 2017.
What happened
Motherboard reported in 2017 that the data had been stolen from CashCrate and was circulating. The breach dated back to November 2016. CashCrate blamed third-party forum software, according to reporting at the time.
HIBP added the data on 20 April 2018.
What was exposed
The data includes names, physical addresses, email addresses and passwords. Passwords for older accounts were stored in plain text, which means anyone with the data could read them. Newer accounts had weak MD5 hashes, which can be cracked quickly.
A name, home address and email together are enough for convincing phishing and for mail-based scams that use your real details. Plain-text passwords are the bigger risk if you reused the same one on other sites, because attackers can try it straight away.
The company's response
CashCrate said users who had logged in since October 2013 had properly hashed and salted passwords. It also acknowledged that some inactive accounts still had plain-text passwords and said these would be hashed and salted.
What to do if you were in it
- 1
Change the password here and anywhere you reused it
If you used this password on another site, change it there first. Use a unique password for every account, ideally from a password manager.
- 2
Turn on two-factor authentication
Add an authenticator app or security key to your email, banking and shopping accounts so a stolen password alone isn't enough.
- 3
Expect phishing by email and post
Your name, address and email were exposed together. Be wary of messages about survey payouts, gift cards or account problems.
- 4
Run a free breach check
Check whether your email or phone number shows up in this and other breaches with a free Serus scan.
Frequently asked
Was I affected by the CashCrate breach?
If you had a CashCrate account around 2016, possibly. HIBP lets you search your email address, and a free Serus scan checks it against this and other breaches.
What was exposed in the CashCrate breach?
Names, physical addresses, email addresses and passwords. Older accounts had plain-text passwords and newer ones had MD5 hashes.
Should I change my password?
Yes, here and on any site where you used the same password, and turn on two-factor authentication where it's offered.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
