Ducks Unlimited ducks.org Ducks Unlimited data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
A Ducks Unlimited database dating to January 2021 was traded online. Have I Been Pwned counts 1,324,364 email addresses, with names, phone numbers, physical addresses, dates of birth and passwords stored as unsalted MD5 hashes.
View all 13,118 breaches- Breach date
- 29 Jan 2021
- Affected
- 1,324,364
- Data exposed
- Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In mid-2021, Risk Based Security reported that a database from the conservation group Ducks Unlimited was being traded online. Have I Been Pwned says the data dated back to January 2021 and held 1,324,364 unique email addresses across a membership list and a list of website users. It was added on 16 November 2021.
Sources checked: haveibeenpwned.com, riskbasedsecurity.com
Last verified against the official page:
What was exposed
The data included email addresses, names, phone numbers, physical addresses, dates of birth and passwords. The passwords were stored as unsalted MD5 hashes, which are quick to crack.
What it means for you
This is a fuller profile than most account leaks. A name, home address, phone number and date of birth together are what scammers need for convincing phishing and for pretending to be you with a phone carrier or a bank. A scam that mentions a membership or website account you really had will look believable, because the data came from those lists. If you reused your password, change it everywhere.
Risk Based Security's June 2021 report is the source Have I Been Pwned cites for this incident.
What to do if you were in it
- 1
Change your password, and any reuse of it
Change your Ducks Unlimited password, then change it on every other account where you used the same or a similar one. Use a password manager so each account gets a unique password, and turn on two-factor login where it's offered.
- 2
Expect phishing that mentions the breach
Scammers use leaked email addresses and phone numberses to send convincing messages. Don't click links in unexpected emails or texts about your account, and go to the site directly instead.
- 3
Watch for identity theft
Your date of birth and address may be exposed. In the US, consider freezing your credit at Equifax, Experian and TransUnion (it's free), and check your statements for accounts or charges you don't recognise.
- 4
Be wary of calls and texts
With your phone number and address in the data, callers may sound like they know you. Hang up and call back on a number from the organisation's official site.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus keeps monitoring breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Ducks Unlimited breach?
If you were a member or website user in early 2021, your email may be one of the 1,324,364 in the data. Check it on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, phone numbers, physical addresses, dates of birth and passwords stored as unsalted MD5 hashes.
Should I change my password?
Yes, and change it on every other account that used the same password.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
