Coinmama coinmama.com Coinmama data breach: what happened and what to do
In August 2017 the crypto brokerage Coinmama suffered a data breach affecting about 479,000 subscribers, discovered in February 2019. Have I Been Pwned counts 478,824 accounts, with email addresses, usernames and passwords stored as MD5 WordPress hashes.
View all 13,115 breaches- Breach date
- 3 Aug 2017
- Affected
- 478,824
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Coinmama, a service for buying cryptocurrency, suffered a data breach in August 2017. It wasn't discovered until February 2019. Have I Been Pwned counts 478,824 accounts and added the data on 30 August 2019. The data was provided to HIBP by security researcher Adam Davies.
In a notice on 15 February 2019, Coinmama said the affected data covered about 450,000 email addresses and hashed passwords of users who registered before 5 August 2017, as reported by databreaches.net. It said it had no evidence the data had been misused and asked affected users to reset their passwords at next login, per CISO Mag. The company also said it doesn't store credit card information, according to The Block.
What was exposed
Email addresses, usernames and passwords stored as MD5 WordPress hashes. MD5 is an old, fast hashing method, so simple passwords can be cracked from the hashes quickly.
Why it matters
People who hold crypto are a target. A criminal with your email address and a cracked password can try both on your exchange and wallet accounts, and can send phishing that mentions crypto to look real. Never share a recovery phrase or approve a login because an email says to.
What to do
Change your Coinmama password and any other that matched it, and turn on two-factor login on every exchange and wallet account.
What to do if you were in it
- 1
Change the password, and every reuse of it
Change your Coinmama password, then change any other account that used the same one. Start with your email and any crypto exchange.
- 2
Turn on two-factor login on exchange and wallet accounts
Use an authenticator app or security key instead of SMS where you can.
- 3
Expect crypto phishing
Your email address was exposed. Ignore messages asking for a recovery phrase, a wallet connection or a login confirmation, and go to the site yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't delete breach data, but it tells you what to change.
Frequently asked
Was I affected by the Coinmama data breach?
Enter your email address on Have I Been Pwned to see whether it was in the data. A free Serus scan also checks breach databases for your email and phone.
What was exposed in the Coinmama breach?
Email addresses, usernames and passwords stored as MD5 WordPress hashes, per Have I Been Pwned.
Were my coins at risk?
The sources describe emails, usernames and hashed passwords, not wallet contents. Coinmama said it doesn't store credit card details. A reused password is still a risk, so change it and use two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
