Drizly drizly.com Drizly data breach: what happened and what to do
In about July 2020, alcohol delivery service Drizly was breached. The data was sold online and widely redistributed. It covers 2,479,044 accounts: emails, names, physical and IP addresses, phone numbers, dates of birth and passwords stored as bcrypt hashes.
View all 13,115 breaches- Breach date
- 2 Jul 2020
- Affected
- 2,479,044
- Data exposed
- Dates of birth, Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In about July 2020, the US online alcohol delivery service Drizly suffered a data breach. The data was sold online before being widely redistributed. Have I Been Pwned (HIBP) added it in July 2020 and counts 2,479,044 accounts, about 2.5 million unique email addresses. TechCrunch covered it when it surfaced.
What was exposed
The data holds a lot of personal detail: email addresses, names, physical addresses, IP addresses, phone numbers, dates of birth and device information. Passwords were stored as bcrypt hashes, which are hard to crack if the password was strong.
A name, home address and date of birth together are the building blocks of identity fraud, and they make phishing believable. Expect messages that look like delivery or order notices, or calls that quote your address. Dates of birth don't change, so this data stays useful to criminals for years.
What the company said
The account count and data types come from HIBP's entry. TechCrunch's report is the news source for the breach.
What to do if you were in it
- 1
Change your password, and every reuse of it
Change it on Drizly first, then on any other account that uses the same or a similar password. A password manager makes unique ones easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where you can, so a leaked password alone isn't enough to get in.
- 3
Expect delivery-themed phishing and scam calls
Be careful with texts or emails about orders, refunds or account problems, and don't click links in them. Open the app or site yourself.
- 4
Watch for identity misuse
Your name, address and date of birth leaked. Check your credit reports for free at annualcreditreport.com and consider a free credit freeze at Equifax, Experian and TransUnion if you want extra protection.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak. It can't remove data that has already leaked, so the steps above are what protect you.
Frequently asked
Was I affected by the Drizly data breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 2,479,044 accounts.
What was exposed?
Dates of birth, device information, email addresses, IP addresses, names, phone numbers, physical addresses and passwords stored as bcrypt hashes.
Should I change my password?
Yes, on Drizly and anywhere you reused it, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
