HauteLook hautelook.com HauteLook data breach: what happened and what to do
In mid-2018, fashion shopping site HauteLook was breached. Over 28 million email addresses leaked with names, genders, dates of birth, locations and bcrypt password hashes, and the data was sold in early 2019.
View all 13,115 breaches- Breach date
- 7 Aug 2018
- Affected
- 28,510,459
- Data exposed
- Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In mid-2018, the fashion shopping site HauteLook was among a group of sites that were breached. The data was then sold in early 2019, a sale The Register covered as account details from 16 sites offered on the dark web.
What was exposed
The data includes about 28.5 million unique email addresses, names, genders, dates of birth and geographic locations. Passwords were stored as bcrypt hashes, which are slow to crack but not immune.
What it means for you
The date of birth is the part that lasts. You can change a password, but not your birthday, and a name plus a birth date helps criminals answer security questions or build a profile for identity fraud. The email and name also support phishing about orders and sales.
Can the data be taken down?
No. Once a breach is copied and shared, nobody can pull it back, and the company can't either. What you control is how useful the data is to criminals: unique passwords, two-factor login and skepticism toward messages that quote your details. Serus monitors breach databases and the dark web for your email and phone and alerts you when your details appear in a new leak.
What to do
Change your password wherever you reused it, turn on two-factor login, and consider a credit freeze if you want extra protection against identity theft.
What to do if you were in it
- 1
Change your HauteLook password, and any you reused
If you used the same or a similar password on another account, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey on your email and other important accounts. It blocks most takeovers even when a password is already out.
- 3
Protect your identity data
A leaked date of birth can't be changed. Watch your accounts for unfamiliar activity, and consider a free credit freeze at Equifax, Experian and TransUnion if you want extra protection.
- 4
Expect phishing that fits the data
Expect emails about orders, sales or your account that use your name. Go to the retailer yourself instead of clicking links.
- 5
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up again.
Frequently asked
Was I affected by the HauteLook breach?
Check your email on Have I Been Pwned or run a free Serus scan. If you had a HauteLook account in 2018, assume yes.
What was exposed?
Email addresses, names, genders, dates of birth, geographic locations and bcrypt password hashes.
Should I change my password?
Yes, anywhere you reused it, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
