Chatbooks chatbooks.com Chatbooks data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In March 2020 the photo book service Chatbooks was breached and the data was offered for sale. About 2.5 million unique email addresses were exposed, with names, phone numbers, social media profiles and hashed passwords. Chatbooks said card data wasn't stored.
View all 13,118 breaches- Breach date
- 26 Mar 2020
- Affected
- 2,520,441
- Data exposed
- Email addresses, Names, Passwords, Phone numbers, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Chatbooks turns photos from Instagram, Facebook and phones into printed books. In May 2020 it told customers that a hacker had stolen user records and put them up for sale. Have I Been Pwned dates the breach to 26 March 2020 and describes 15 million records covering 2,520,441 unique email addresses.
Chatbooks said it learned of the intrusion on 5 May, two days after the records were advertised. Its CEO posted a statement saying most of the data was names, email addresses and salted, hashed passwords.
Sources checked: haveibeenpwned.com, bleepingcomputer.com
Last verified against the official page:
What was exposed
Have I Been Pwned lists email addresses, names, passwords, phone numbers and social media profiles. The passwords were salted SHA-512 hashes, which makes them harder to crack than plain hashes but doesn't help if you chose a weak one.
Chatbooks said it doesn't store payment card details and had seen no sign that anyone accessed customers' photos.
What it means for you
Password reuse is the first risk. After that comes phishing: a name, email and phone number is enough to send a message that looks like it came from a photo service. Social media profile details let a scammer personalise it further.
The leaked data can't be pulled back, so the answer is making it less useful.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on Chatbooks, then change it on any other account that used the same or a similar one. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey wherever the site offers it. It blocks most account takeovers even when an old password is out there.
- 3
Expect phishing that uses these details
Criminals can use leaked names, emails and phone numbers to write messages that look personal. Don't click links in unexpected emails or texts. Go to the company's site yourself.
- 4
Review linked social accounts
Chatbooks connects to Instagram and Facebook. If you linked accounts, check the connected apps in each account's settings and remove any you don't recognise.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone number and other details and alerts you when they show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Chatbooks breach?
If you had a Chatbooks account in early 2020, possibly. Check your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, phone numbers, social media profiles and salted SHA-512 password hashes.
Were my photos or card details taken?
Chatbooks said it saw no evidence that photos were accessed and that it doesn't store payment card details.
Should I change my password?
Yes, on Chatbooks and anywhere you reused it.
Sources
- Have I Been Pwned: Chatbooks
- Have I Been Pwned: Chatbooks Data Breach · haveibeenpwned.com
- ChatBooks discloses data breach after data sold on dark web · bleepingcomputer.com
Something wrong or out of date? Tell us and we'll re-check it.
