Evite evite.com Evite data breach: what happened and what to do
In April 2019 Evite found unauthorized access to a database archive dating back to 2013. HIBP counts about 101 million unique email addresses. Members also had names, phone numbers, addresses, dates of birth, genders and passwords exposed.
View all 13,115 breaches- Breach date
- 11 Aug 2013
- Affected
- 100,985,047
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In April 2019, the invitation service Evite identified a data breach. Investigators found that someone had gained unauthorized access to an inactive database archive that dated back to 2013. Evite's own security notice says no user information more recent than 2013 was in the file.
What was exposed
Have I Been Pwned (HIBP) counts 100,985,047 unique email addresses. Most belong to people who received invitations. They never had an account. Members had more in the file. HIBP lists names, phone numbers, addresses, birth dates, genders and passwords. The passwords were stored in plain text, so a leaked copy could be read as is.
What criminals can do with it
A plain-text password is the most dangerous item. Anyone who used that password elsewhere in 2013 and never changed it is exposed on those other accounts too. Identity fraud needs a name, an address and a birth date, and this file has all three for members. Phone numbers feed smishing (scam texts).
The data is from 2013, so some of it is stale. Birth dates don't go stale.
The company's response
Evite said it hired an outside data security firm and notified law enforcement. Reports at the time said it reset user passwords. No Social Security numbers or payment details were in the file, Evite said.
What to do if you were in it
- 1
Change your password and any copy of it
Change your Evite password, then change it on every other account where you used the same or a similar one. If you ever used your Evite password anywhere else, that's the one to prioritize, because it was stored in plain text. Turn on two-factor login where it's offered, and use a password manager so each account gets its own password.
- 2
Expect phishing that uses real details
With your name, phone number and address in circulation, scammers can send emails or texts that look personal. Don't click links in unexpected messages, and go to the company's site directly instead.
- 3
Watch for identity misuse
Dates of birth plus names and addresses are what fraudsters use to open accounts. Check your credit reports at annualcreditreport.com. A free credit freeze with each bureau blocks new accounts.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Evite breach?
If you ever received an Evite invitation or had an account before 2013, possibly. HIBP lists about 101 million email addresses, so check yours on Have I Been Pwned or with a free Serus scan.
What was exposed in the Evite breach?
Email addresses for everyone. Members also had names, phone numbers, addresses, birth dates, genders and plain-text passwords.
Should I change my password after the Evite breach?
Yes, on Evite and anywhere you reused the same password. Use a unique one for each account and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
