GeniusU geniusu.com GeniusU data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
GeniusU, an online platform for entrepreneurs, had a breach in October 2020 that exposed 1.3 million accounts: names, email and IP addresses, genders, social media profile links and bcrypt password hashes.
View all 13,118 breaches- Breach date
- 2 Oct 2020
- Affected
- 1,301,460
- Data exposed
- Email addresses, Genders, IP addresses, Names, Passwords, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
GeniusU is an online platform for entrepreneurs. In October 2020, its user data was taken, and in November 2020 it was made public as part of a larger collection of leaked databases.
What was exposed
Have I Been Pwned lists 1.3 million records with names, email addresses, IP addresses, genders, links to social media profiles and passwords stored as bcrypt hashes.
What that means for you
Bcrypt is a slow, strong way to store passwords, so a long, unique password is hard to crack. A short or common one is not. If you reused your GeniusU password, change it everywhere you used it.
The larger risk is phishing. Your name, email and a link to your social profile tell a scammer where you work and what you care about. Business-flavored lures such as fake investor emails, invoice requests or course offers fit this profile well.
There is no financial data in the list, so card numbers were not part of it. The exposed IP addresses are a smaller concern, but they can hint at roughly where you live, which a scammer can use to make a message feel local. Breaches that circulate as part of a bigger collection tend to be copied and resold, so the data can keep resurfacing long after the original incident.
Sources checked: haveibeenpwned.com
Last verified against the official page:
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new, unique password on GeniusU first. Then change it on any other account that shares the old one, starting with your email. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Use an authenticator app on your email, bank and shopping accounts. A leaked password alone then won't get anyone in.
- 3
Watch for business-themed phishing
Treat unexpected emails about funding, partnerships or invoices with suspicion, especially if they use your name or job.
- 4
Check whether your email is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your email or phone number shows up. It can't remove data from a breach, but it tells you which accounts to secure first.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the GeniusU breach?
If you had a GeniusU account in 2020, assume yes. Check your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the GeniusU breach?
Names, email addresses, IP addresses, genders, social media profile links and bcrypt password hashes.
Should I change my password?
Yes, on GeniusU and anywhere you reused it.
Sources
- Have I Been Pwned: GeniusU
- Have I Been Pwned: GeniusU Data Breach · haveibeenpwned.com
Something wrong or out of date? Tell us and we'll re-check it.
