Dubsmash data breach: what happened and what to do

Dubsmash is a short-video app where people lip-sync to sound clips. Have I Been Pwned (HIBP) dates its breach to December 2018 and added the data to its database on February 25, 2019.

What happened

In early 2019 a large set of Dubsmash user data was offered for sale alongside several other big breaches. The data came to HIBP from a source who asked to be credited. Some outlets give February 2019 as the date of the breach, but HIBP dates the data itself to December 2018, which is the date this page uses.

HIBP's copy holds 161,749,950 accounts. That makes it one of the larger breaches in HIBP's list.

What was exposed

HIBP lists these data types:

• Email addresses
• Usernames and names
• Phone numbers
• Geographic locations
• Spoken languages
• Passwords (as hashes)

The passwords were hashed with PBKDF2, a method designed to slow down cracking, so they weren't stored in plain text. That helps, but weak or common passwords can still be recovered by guessing.

What criminals can do with it

The mix of name, email, phone number and location is what a scammer needs for a believable message. Expect text messages and emails that mention Dubsmash or use your real name. Phone numbers also open the door to SIM swap attempts, where a criminal convinces your carrier to move your number to a SIM card they control, then uses it to intercept login codes.

Any account where you used the same password as Dubsmash is at risk if your password was cracked. Attackers try leaked email and password pairs on banks, email providers and shopping sites. That's called credential stuffing.

The company's response

A 2019 report said Dubsmash hadn't notified affected users or asked them to change their passwords at that point. None of the sources used here describe a later notice.

What to do about an old breach

If you had a Dubsmash account around 2018, assume your details are in circulation. The breach itself can't be undone, since the data has been copied. Your job is to make that data less useful: change reused passwords, switch on two-factor authentication, and ask your mobile carrier about a port-out PIN.

Serus can't remove breach data, but it monitors breach databases and the dark web for your email, phone number and other details, and alerts you when something new shows up. The steps below are the ones to do first.

How to check your own exposure

Search your email address on Have I Been Pwned, which is free and doesn't ask for a password. If Dubsmash is listed, your email is in the file. Check older and secondary addresses too, since people often sign up for short-video apps with an address they rarely use anymore.