ClickASnap clickasnap.com ClickASnap data breach: what happened and what to do
In September 2022, ClickASnap suffered a data breach that exposed 3,262,980 accounts: email addresses, names, passwords stored as SHA-512 hashes, physical addresses, purchases and usernames. Change any reused password and watch for phishing.
View all 13,177 breaches- Breach date
- 24 Sept 2022
- Affected
- 3,262,980
- Data exposed
- Email addresses, Names, Passwords, Physical addresses, Purchases, Social media profiles, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
ClickASnap is an online photo-sharing platform. In September 2022 it suffered a data breach, and the data was later added to Have I Been Pwned (HIBP) in March 2024. The company published its own notice on its blog in October 2022.
HIBP says the incident exposed about 3.3 million records: 3,262,980 accounts in all. The breach date HIBP gives is 24 September 2022.
Sources checked: haveibeenpwned.com, cisa.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
HIBP lists these kinds of data: email addresses, names, passwords, physical addresses, purchases, social media profiles and usernames. The passwords were stored as SHA-512 hashes, a scrambled form that is harder to read than plain text but that determined attackers can still try to crack, especially when a password is short or common. A collection of paid subscriptions was also included, with names, physical addresses and the amounts paid.
What that lets criminals do
A password that was reused is the first concern. Attackers try leaked email and password pairs on other sites, a technique called credential stuffing. If your ClickASnap password matches one you use on email, banking or shopping sites, change those first.
The email addresses and names also feed phishing. A message that names you and mentions photo sharing, a subscription or a payment can look real. If you were a paying subscriber, the physical address and payment amounts make a convincing invoice scam easier to build.
What to do
Change your ClickASnap password and any account that shares it, and turn on two-factor authentication where it's offered. The CISA guidance linked below explains both. Then treat unexpected messages about your account or a payment with caution, and look up the company's site yourself instead of clicking a link in the message.
What to do if you were in it
- 1
Change your password everywhere you reused it
Start with email and banking. CISA recommends long, unique passwords (guide).
- 2
Turn on two-factor authentication
Use it on your email and any important account. See CISA's guide.
- 3
Watch for phishing
Be skeptical of messages that mention ClickASnap or a payment. The FTC's phishing guide says to contact the company using details you already trust.
- 4
Check your other breaches
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you, but it can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the ClickASnap breach?
Search your email on Have I Been Pwned. The entry covers 3,262,980 accounts.
What was exposed?
Email addresses, names, passwords (SHA-512 hashes), physical addresses, purchases, social media profiles and usernames.
Should I change my password?
Yes, and on any other site where you used the same one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
