DataCamp datacamp.com DataCamp data breach: what happened and what to do
In December 2018, data science site DataCamp was breached, exposing records back to January 2017. About 760,000 email addresses leaked with IP addresses, names, locations and bcrypt password hashes.
View all 13,115 breaches- Breach date
- 30 Jan 2017
- Affected
- 760,561
- Data exposed
- Email addresses, Geographic locations, IP addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In December 2018, the data science learning site DataCamp suffered a data breach affecting records dating back to January 2017. In 2019 the data was listed for sale on the dark web and then circulated more widely. In its security update, DataCamp said it emailed affected users, logged out possibly affected accounts, required password resets for password logins and brought in a forensic firm.
What was exposed
About 760,000 unique email addresses leaked, with IP addresses, names, geographic locations and passwords stored as bcrypt hashes. DataCamp said it does not store payment card data.
What it means for you
Names with email addresses support phishing that mentions your learning account or a course. The bcrypt hashes are slow to crack, so the risk is mainly for weak or reused passwords.
Can the data be taken down?
No. Once a breach is copied and shared, nobody can pull it back, and the company can't either. What you control is how useful the data is to criminals: unique passwords, two-factor login and skepticism toward messages that quote your details. Serus monitors breach databases and the dark web for your email and phone and alerts you when your details appear in a new leak.
What to do
Change your password wherever you reused it and turn on two-factor login.
What to do if you were in it
- 1
Change your DataCamp password, and any you reused
If you used the same or a similar password on another account, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey on your email and other important accounts. It blocks most takeovers even when a password is already out.
- 3
Expect phishing that fits the data
Expect emails about courses, certificates or your account that use your name. Go to the site yourself instead of clicking.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up again.
Frequently asked
Was I affected by the DataCamp breach?
Check your email on Have I Been Pwned or run a free Serus scan. DataCamp said it contacted affected users by email.
What was exposed?
Email addresses, IP addresses, names, geographic locations and bcrypt password hashes.
Were payment details exposed?
DataCamp said it does not store payment card data.
Should I change my password?
Yes, anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
