Exploit.In data breach: what happened and what to do
In late 2016 a combo list called Exploit.In circulated with 593 million unique email addresses, many paired with several passwords. It was a compilation from many hacked systems, not one company's breach, and attackers used it for credential stuffing.
View all 13,115 breaches- Breach date
- 13 Oct 2016
- Affected
- 593,427,119
- Data exposed
- Email addresses, Passwords
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What it is
Exploit.In isn't a breach of one company. It's a "combo list": a file of email address and password pairs collected from many hacked online systems and passed around. Have I Been Pwned describes it as appearing in late 2016, with 593 million unique email addresses, many with several different passwords. HIBP marks it as unverified, because there's no single source to check it against.
How criminals use a list like this
The list was widely circulated and used for credential stuffing: attackers feed the pairs into the login pages of other services to see which ones still work. It only succeeds against people who reuse a password across sites. Troy Hunt, who runs HIBP, wrote about it in Password reuse, credential stuffing and another billion records in Have I Been Pwned.
What was exposed
Email addresses and passwords. Nothing else is listed.
What this means for you
If your email address is in it, assume at least one of your old passwords is known. The risk is mostly to any account that still uses that password, or a close variation of it. A password manager that gives every site its own password ends the problem, and two-factor login blocks most takeover attempts even when a password is right.
What to do if you were in it
- 1
Change the password everywhere you used it
Start with email, banking, shopping and anything that stores a card. Use a different password for each site, ideally from a password manager.
- 2
Turn on two-factor authentication
An authenticator app or a passkey stops most takeover attempts even when someone has your password.
- 3
Watch for login alerts
Treat unexpected sign-in or password reset emails as a sign that someone is trying your details.
- 4
Check other breaches
Check whether your email or phone number shows up in this and other breaches. A free scan from Serus looks across breach databases and the dark web and alerts you when your data appears.
Frequently asked
Was I in the Exploit.In list?
You can search your email address on Have I Been Pwned, which holds the list's 593 million addresses.
Was this a hack of one company?
No. It was a compilation of email and password pairs taken from many systems, which is why HIBP lists it as unverified.
Should I change my password?
Yes, if you've reused a password on more than one site. Change it everywhere and use a unique one for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
