Funimation funimation.com Funimation data breach: what happened and what to do
In July 2016, anime streaming site Funimation was breached, affecting 2.5 million accounts: usernames, email addresses, dates of birth and salted SHA1 password hashes. It became public in February 2017. Change reused passwords and watch for phishing.
View all 13,115 breaches- Breach date
- Jul 2016
- Affected
- 2,491,103
- Data exposed
- Dates of birth, Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In July 2016, the anime site Funimation suffered a data breach that affected 2.5 million accounts. The breach became public in February 2017, when Have I Been Pwned added it on 20 February. Funimation told Anime Herald that in August 2016 it learned its web application forum software had been the subject of a sophisticated intrusion.
What was exposed
Usernames, email addresses, dates of birth and salted SHA1 hashes of passwords. The date of birth matters most here. Unlike a password, you can't change it, and it is one of the details used to verify your identity.
What it lets criminals do
Email plus date of birth lets a scammer write a convincing message that proves they "know" you, and it can help them answer account security questions elsewhere. If your password was short or reused, attackers can try it on other services.
The company's response
Funimation said the intrusion hit its forum software and that passwords were stored in encrypted form. The hashes were still part of the exposed data.
What to do if you were in it
- 1
Change your password here and anywhere you reused it
Set a new password on Funimation if you still have an account. Then change it on any other account that used the same or a similar password. A password manager makes unique ones easy.
- 2
Turn on two-factor login
Use an authenticator app or a hardware key on your email, banking and shopping accounts first, since those are what an attacker targets.
- 3
Treat your date of birth as exposed
It can't be changed, so be careful with callers or emails that quote it to prove they are legitimate. Contact the company through its official site instead.
- 4
Expect phishing about streaming or anime accounts
Messages about billing problems or locked accounts are a common follow-up. Don't click links in them.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone, and get alerts if new ones appear.
Frequently asked
Was I affected by the Funimation breach?
Search your email address on Have I Been Pwned, or run a free Serus scan to check breach databases for your email and phone.
What was exposed in the Funimation breach?
Usernames, email addresses, dates of birth and salted SHA1 password hashes for 2.5 million accounts.
Why did it take until 2017 to come out?
The intrusion happened in July 2016 and Funimation says it learned of it in August 2016. The data was added to Have I Been Pwned in February 2017, when the breach became widely known.
Should I change my password?
Yes, anywhere you used the same password. Use a unique one per site and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
