Gravatar gravatar.com Gravatar data breach: what happened and what to do
In October 2020 a researcher showed how to scrape Gravatar profiles at scale. HIBP counts about 114 million email addresses with names and usernames that were cracked from MD5 hashes and shared. Gravatar says it wasn't hacked and the data was public.
View all 13,115 breaches- Breach date
- 3 Oct 2020
- Affected
- 113,990,759
- Data exposed
- Email addresses, Names, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Gravatar is the service that attaches an avatar to your email address on sites like WordPress. In October 2020, a security researcher published a technique for scraping large volumes of Gravatar profile data. Have I Been Pwned (HIBP) says 167 million names, usernames and MD5 hashes of email addresses were scraped and shared in hacking circles.
What was exposed
An MD5 hash is a scrambled version of an email address. Gravatar uses it to look up your avatar. About 114 million of those hashes were cracked, and the original email address was shared next to the hash. HIBP lists 113,990,759 email addresses, with names and usernames.
A disputed breach
Gravatar's position, according to its data privacy page, is that this was scraping of public profile data and not a hack. Coverage at the time said Gravatar patched the ability to harvest profiles in bulk. HIBP still counts it, because people's email addresses were exposed in a way they didn't expect.
What this means for you
No passwords or financial details are listed. The risk is linking: your email address, name and username now appear together in a list that anyone can search. That helps phishers and anyone building a profile of you.
What to do if you were in it
- 1
Expect phishing that uses real details
With your email address, name and username in circulation, scammers can send emails or texts that look personal. Don't click links in unexpected messages, and go to the company's site directly instead.
- 2
Review your public Gravatar profile
Log in to Gravatar and remove any name, links or details you don't want public. Anything on your profile can be scraped.
- 3
Use a separate email for public profiles
An address you use only for avatars, comments and sign-ups keeps your main inbox out of scraped lists.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Gravatar breach?
If your email had a Gravatar profile in 2020, possibly. HIBP lists 113,990,759 email addresses. Check yours on Have I Been Pwned or with a free Serus scan.
What was exposed in the Gravatar breach?
Email addresses, names and usernames. Passwords and payment details aren't listed.
Was Gravatar hacked?
Gravatar says the data was scraped from public profiles through its API and that it isn't a data breach. HIBP added it because the scraped email addresses were distributed.
Sources
- Have I Been Pwned: Gravatar
- haveibeenpwned.com/Breach/Gravatar
- en.gravatar.com/support/data-privacy
- bleepingcomputer.com/news/security/online-avatar-service-gravatar-allows-mass-collection-of-user-info/
- wptavern.com/gravatar-says-it-was-not-hacked-after-have-i-been-pwned-service-notifies-users-of-a-breach
Something wrong or out of date? Tell us and we'll re-check it.
