Dailymotion dailymotion.com Dailymotion data breach: what happened and what to do
In October 2016 the video platform Dailymotion suffered a breach that exposed more than 85 million user accounts: email addresses, usernames and bcrypt password hashes. Have I Been Pwned counts 85,176,234 accounts and added it in August 2017.
View all 13,115 breaches- Breach date
- 20 Oct 2016
- Affected
- 85,176,234
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Dailymotion, the video sharing platform, suffered a data breach in October 2016. Have I Been Pwned (HIBP) recorded more than 85 million user accounts from it and added the data to its database in August 2017. HIBP marks the breach as verified.
What was exposed
HIBP lists three kinds of data: email addresses, usernames and passwords. The passwords were stored as bcrypt hashes. Bcrypt is a deliberately slow hashing method built to make cracking expensive, so these hashes are a good deal harder to crack than the unsalted MD5 hashes seen in many older breaches. Strong, unique passwords are unlikely to be recovered. Weak or common ones can still be guessed.
What it means for you
The main risk is to your email address and any account that shares the Dailymotion password. If you used a short or common password, assume it can be guessed. Your email address is now in lists that spammers and phishers trade, so unexpected messages that mention video sites or account problems deserve a second look.
Because the breach dates from 2016, the useful check is whether you still reuse that password.
The company's response
HIBP links to The Hacker News coverage from December 2016. Dailymotion's own statements aren't part of HIBP's record, and this page covers only what HIBP lists.
What to do if you were in it
- 1
Change the password here and anywhere you reused it
Set a new password on the affected account, then change it on every other account where you used the same or a similar one. A password manager makes unique passwords easy. Turn on two-factor login where the site offers it.
- 2
Treat unexpected emails that mention the breach with suspicion
Criminals use breach details to make scam emails look real. Don't click links in a message you didn't expect. Go to the company's site by typing the address yourself.
- 3
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases for your email address and phone number, and Serus monitors the dark web and breach databases and alerts you when your details turn up again. Breach data can't be taken back once it has leaked, so the scan tells you what to change, not what to delete.
Frequently asked
Was I affected by the Dailymotion data breach?
If your email address is in Have I Been Pwned's Dailymotion entry, yes. A Serus free scan checks this and other breaches.
What was exposed in the Dailymotion breach?
Email addresses, usernames and bcrypt password hashes, according to Have I Been Pwned.
Are bcrypt hashes safe?
Bcrypt is slow to crack, so strong unique passwords are unlikely to be recovered. Weak or common passwords can still be guessed, so change any you reused.
How many accounts were in the Dailymotion breach?
Have I Been Pwned counts 85,176,234 accounts.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
