DatPiff datpiff.com DatPiff data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In late 2021, email and password pairs from the rap mixtape site DatPiff appeared for sale online. Have I Been Pwned counts 7,476,940 accounts, with usernames, security questions and answers, and cracked passwords. The data may be older than 2021.
View all 13,118 breaches- Breach date
- 25 Aug 2021
- Affected
- 7,476,940
- Data exposed
- Email addresses, Passwords, Security questions and answers, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Have I Been Pwned says that in late 2021, email address and plain text password pairs from the rap mixtape site DatPiff appeared for sale on a hacking forum. In total it held 7,476,940 accounts. Have I Been Pwned dates the breach to 25 August 2021 and added it on 4 January 2022.
The data allegedly came from an earlier breach, and security coverage reported that versions of the database had been traded since 2020. The original source allegedly held usernames, security questions and answers, and passwords stored as MD5 hashes with a static salt.
Sources checked: haveibeenpwned.com, numerama.com
Last verified against the official page:
What was exposed
Email addresses, passwords, security questions and answers, and usernames.
What it means for you
Plain text passwords are the worst case: no cracking is needed, and anyone with the file can try them on other sites. Security questions and answers can help someone reset accounts elsewhere, especially if you gave the same real answers, such as a first school or a pet's name, on other services. Because the data is probably old, any account you've changed since may be safe, but anything still using the same password is not.
What to do if you were in it
- 1
Change your password, and any reuse of it
Change your DatPiff password, then change it on every other account where you used the same or a similar one. Use a password manager so each account gets a unique password, and turn on two-factor login where it's offered.
- 2
Change security answers you reused
If you gave real answers to security questions, change them wherever else you used them. Better, treat the answers like passwords: use random answers stored in your password manager.
- 3
Expect phishing that mentions the breach
Scammers use leaked email addresseses to send convincing messages. Don't click links in unexpected emails or texts about your account, and go to the site directly instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus keeps monitoring breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the DatPiff breach?
If you had a DatPiff account, your email may be among the 7,476,940 in the data. Check it on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, passwords, usernames, and security questions and answers.
Should I change my password?
Yes. Passwords appeared in plain text, so change it on DatPiff and anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
