Home Chef homechef.com Home Chef data breach: what happened and what to do
In early 2020 the meal kit company Home Chef had a data breach that exposed almost 9 million customers: names, email addresses, phone numbers, IP addresses, locations, the last 4 digits of cards and bcrypt-hashed passwords.
View all 13,115 breaches- Breach date
- 10 Feb 2020
- Affected
- 8,815,692
- Data exposed
- Email addresses, Geographic locations, IP addresses, Names, Partial credit card data, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Home Chef, a US meal kit delivery company, had a data breach in early 2020. Have I Been Pwned (HIBP) counts 8.8 million accounts.
What happened
The data was sold online in May 2020, and Home Chef then emailed affected customers. The company said not all customers were affected and that it does not store full card numbers. It told customers to change their passwords and watch for phishing.
What was exposed
HIBP lists email addresses, names, phone numbers, IP addresses, geographic locations, partial credit card data (the last 4 digits) and passwords stored as bcrypt hashes. Bcrypt is a strong hashing method, so strong passwords are hard to crack.
What it means for you
The last 4 digits of a card are not enough to use it, but scammers like them: a message that quotes the last 4 digits of your card sounds like it came from your bank. Treat those messages with care. Change your Home Chef password and any matching one elsewhere.
How to check your exposure
Search your email address on Have I Been Pwned, which holds this dataset and lets you check for free. If it shows up, change the password on every account that shared it. Also check your card statements for charges you don't recognize, even though full numbers were not part of the data.
What to do if you were in it
- 1
Change your password and turn on 2FA
Set a new, unique password for Home Chef. If you used that password anywhere else, change it there too, and turn on two-factor login on your important accounts. A password manager makes unique passwords easy.
- 2
Expect phishing and text scams that mention the breach
Treat unexpected emails, calls and texts that use your name, phone number or address with suspicion. Don't click links in them. Go to the company's site by typing the address yourself.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures early. It can't remove data from a breach, which is why the steps above matter.
Frequently asked
Was I affected by the Home Chef breach?
Check your email on Have I Been Pwned. If Home Chef is listed, you were in the data. The company also emailed affected customers.
Were full card numbers exposed?
No. Home Chef said it does not store full card numbers. The data had the last 4 digits only.
Should I change my password?
Yes. Home Chef told customers to do so, and you should also change it anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
