Cit0day cit0day.in Cit0day data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Cit0day is a collection of more than 23,000 allegedly breached websites that circulated in November 2020. It holds 226 million unique email addresses paired with passwords, many in plain text. Have I Been Pwned lists it as unverified.
View all 13,118 breaches- Breach date
- 4 Nov 2020
- Affected
- 226,883,414
- Data exposed
- Email addresses, Passwords
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In November 2020, a collection of more than 23,000 allegedly breached websites, known as Cit0day, was made available for download on several hacking forums. Have I Been Pwned added it on 19 November 2020.
This isn't one company's breach. It's a bundle of many. Troy Hunt, who runs Have I Been Pwned, described the source as a large archive of thousands of separate files. Have I Been Pwned says independent verification found it contains many legitimate, previously undisclosed breaches, but it labels the collection unverified because the individual sites can't all be confirmed.
Sources checked: haveibeenpwned.com, troyhunt.com
Last verified against the official page:
What was exposed
The data holds 226 million unique email address and password pairs. Passwords appear both as hashes and as cracked, plain text versions. That is the dangerous part: a plain text password next to your email can be tried on any site where you used it.
What it lets criminals do
Credential stuffing is the obvious one. Criminals take pairs like these and test them on email, shopping, banking and social accounts at scale. Since the collection doesn't tell you which site your password came from, the safe assumption is that any old password tied to your email could be in it.
What to do
If your email is listed, change the passwords for the accounts you've used it with, starting with email and banking. Use a different password for each site, and turn on two-factor login.
What to do if you were in it
- 1
Change passwords tied to this email
Start with your email, banking and shopping accounts. Use a unique password on every site, kept in a password manager.
- 2
Turn on two-factor login
An authenticator app or passkey blocks most takeovers, even when a password is already out there.
- 3
Retire reused passwords
If one password protects several accounts, replace it on all of them. That's the habit credential stuffing relies on.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number and shows which leaks they appear in.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by Cit0day?
The collection holds 226 million unique email addresses. Look yours up on Have I Been Pwned or run a free Serus scan.
What was exposed in Cit0day?
Email addresses paired with passwords, shown as hashes and as cracked plain text.
Which sites did my data come from?
The collection doesn't say. It bundles data from more than 23,000 allegedly breached websites, so you can't tell which account is behind a match.
Should I change my password?
Yes, if your email is listed. Change the passwords for any account you've used with it, and never reuse one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
