Dave dave.com Dave data breach: what happened and what to do
In June 2020, banking app Dave had a data breach that exposed about 3 million unique email addresses, with names, dates of birth, addresses, phone numbers and bcrypt password hashes. Dave said the breach came through a third-party provider.
View all 13,115 breaches- Breach date
- 28 Jun 2020
- Affected
- 2,964,182
- Data exposed
- Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, Social security numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Dave, a digital banking app, said in July 2020 that a data breach at a third-party provider, Waydev, had exposed the personal information of its users. Waydev was an analytics platform Dave no longer worked with. Waydev said attackers got into its systems and stole GitHub and GitLab access tokens, which they used to reach Dave's data. Have I Been Pwned dates the breach to June 28, 2020 and says the data later appeared for public download.
Have I Been Pwned lists 2,964,182 unique email addresses, across 7.5 million rows of data. The exposed data includes names, email addresses, phone numbers, physical addresses, dates of birth, passwords stored as bcrypt hashes and encrypted Social Security numbers. Dave said bank account numbers, card numbers and transaction records weren't affected, and that unencrypted Social Security numbers weren't exposed. Dave told customers it was working with law enforcement, forced a password reset for all customers and said it had no evidence the attacker took unauthorized actions on any account.
Names, addresses, phone numbers and dates of birth are the building blocks of identity theft, and they make phishing and phone scams sound credible. Because Social Security numbers are in the mix, a credit freeze is worth doing.
What to do if you were in it
- 1
Change your Dave password and any copy of it
If you reuse the Dave password anywhere, change it there too, starting with email and banking. Use a unique password for each account and turn on two-factor authentication where it's offered.
- 2
Freeze your credit
A freeze at Equifax, Experian and TransUnion stops anyone opening new credit in your name. It's free and you can lift it when you need to.
- 3
Treat unexpected emails and texts with suspicion
Criminals use breach details to make scam messages sound real. If a message mentions the breach or asks you to log in, click a link or share a code, go to the company's site yourself instead.
- 4
Watch your accounts
Check your Dave account and bank statements for activity you don't recognize, and report it to the bank right away.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks for your email and phone number in breach databases and the dark web and tells you what to do about each hit. Serus can't pull breach data back, but it alerts you when your details turn up.
Frequently asked
Was I affected by the Dave breach?
Have I Been Pwned lists almost 3 million unique email addresses. Search your email there or run a free Serus scan.
What was exposed in the Dave breach?
Names, email addresses, phone numbers, physical addresses, dates of birth, bcrypt password hashes and encrypted Social Security numbers, according to Have I Been Pwned. Dave said bank account and card numbers weren't affected.
Should I change my password?
Yes. Change it on Dave and anywhere you reused it, and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
