FlipaClip flipaclip.com FlipaClip data breach: what happened and what to do
In November 2024, the animation app FlipaClip exposed almost 900k records through an exposed Firebase server. HIBP lists 892,854 accounts. Exposed: names, email addresses, countries and dates of birth.
View all 13,177 breaches- Breach date
- 18 Nov 2024
- Affected
- 892,854
- Data exposed
- Dates of birth, Email addresses, Geographic locations, Names
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
FlipaClip is an animation app. In November 2024, a misconfigured Firebase server exposed user records. Have I Been Pwned (HIBP) lists 892,854 affected accounts, with the breach dated 18 November 2024 and added on 20 November 2024.
CyberInsider reported that a security researcher flagged the flaw to the developer, Visual Blasters, and that the developer said the issue was fixed. FlipaClip told HIBP the issue has since been rectified.
Sources checked: haveibeenpwned.com, cyberinsider.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
HIBP lists dates of birth, email addresses, geographic locations and names. Per the developer's statement, passwords and financial details weren't reachable.
What that lets criminals do
A name, birth date and email address make phishing more believable. The app is popular with young people, and reports say minors were among the affected users, so parents may want to watch the email addresses their children used.
What to do
No passwords are listed, so the main risk is phishing. If a child's details leaked, the FTC explains how to place a credit freeze for a child.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that mention this breach or ask you to act fast. Don't click links in them; go to the company's site yourself. The FTC explains how to spot phishing.
- 2
If a child's details leaked, consider a freeze
A date of birth and name can be misused for identity theft. The FTC explains credit freezes, including for children, at Equifax, Experian and TransUnion.
- 3
Turn on two-factor login
Add two-factor authentication to your important accounts, starting with email. CISA recommends turning it on wherever it's offered.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the FlipaClip breach?
Search your email on Have I Been Pwned or run a free Serus scan. HIBP lists 892,854 accounts.
What was exposed?
Names, email addresses, countries and dates of birth, according to HIBP.
Were passwords exposed?
HIBP doesn't list passwords, and the developer said passwords and financial details weren't reachable.
Were children affected?
Reports say minors were among the users, since the app is popular with young people. Check any email address a child used.
Sources
- Have I Been Pwned: FlipaClip
- haveibeenpwned.com/Breach/FlipaClip
- cyberinsider.com/flipaclip-data-breach-exposes-895000-user-records-including-minors/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- cisa.gov/secure-our-world/require-strong-passwords
- cisa.gov/secure-our-world/turn-on-mfa
Something wrong or out of date? Tell us and we'll re-check it.
