Hopamedia data breach: what happened and what to do
Data from an unknown service called Hopamedia, dating to 2020, appeared in a publicly exposed database in 2024. Have I Been Pwned counts 23,835,870 accounts: email addresses, names, phone numbers, countries and mobile carriers. No passwords.
View all 13,115 breaches- Breach date
- 30 Aug 2020
- Affected
- 23,835,870
- Data exposed
- Email addresses, Geographic locations, Names, Phone numbers, Telecommunications carrier
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Hopamedia is an odd entry in the breach record: nobody has confirmed what the service actually was. In 2024, data attached to the name appeared in a publicly exposed database. Have I Been Pwned (HIBP) dates the data to 30 August 2020, added it on 16 December 2024 and counts 23,835,870 accounts.
What happened
HIBP describes the data as relating to "an unknown service referred to as Hopamedia". It sat in a database that anyone could reach, with almost 24 million records. There is no company statement and no public notice from Hopamedia. Some online discussion has guessed at a defunct marketing or advertising business, but nothing in HIBP's entry confirms that, so treat it as a guess.
That uncertainty matters for you. You may have no memory of an account anywhere called Hopamedia. Records like these often come from sign-up forms, app promotions or lead-generation sites that collected your details under another brand.
What was exposed
According to HIBP, each record included an email address, a name, a phone number, the person's country and their telecommunications carrier. HIBP lists the data types as email addresses, geographic locations, names, phone numbers and telecommunications carrier.
There are no passwords in the entry, and no payment details.
What that lets criminals do
The phone number and carrier pair is the part worth thinking about. Knowing which carrier holds your number tells a scammer where to aim a SIM swap, where a criminal persuades the carrier to move your number to a SIM they control. If your accounts send login codes by text, a swapped number can let them reset passwords. It takes a determined attacker, but the carrier detail removes a step.
More common is plain phishing and smishing. A text that uses your real name and refers to your mobile provider ("your plan is about to be suspended") looks legitimate. The same goes for email: a message addressed to you by name, with a link to "verify your account" at your carrier, is a classic pattern.
Spam and scam calls are the third effect. Phone numbers from leaked lists get sold and reused for years, so even a 2020 dataset can keep your number on call lists long after.
The company's response
There isn't one on record. HIBP says the data surfaced in 2024 from an exposed database and that the service behind it is unknown. If a notice from a company ever appears, it will be worth reading, but waiting for one isn't a reason to hold off on the steps below.
How to check
Search your email address and your phone number on HIBP. A match tells you the data was in circulation. It doesn't mean any of your accounts were accessed, because no passwords were included.
What to do if you were in it
- 1
Expect phishing that uses your details
Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
- 2
Lock down your phone number
Call your mobile carrier and ask to add a port-out PIN or number lock. That makes a SIM swap harder, which matters because many services still send login codes by text.
- 3
Use an authenticator app instead of text codes where you can
Switch banking, email and social accounts from SMS codes to an authenticator app or a passkey. That takes the phone number out of the login path.
- 4
Don't reply to unknown calls or texts
Don't answer 'STOP' or press a number on a suspicious message. A reply confirms your number is live. Block and report it with your carrier's spam reporting number, 7726 in the US and UK.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the Hopamedia breach?
Search your email address and phone number on Have I Been Pwned. If your details are listed under Hopamedia, they were in the exposed data.
What was exposed?
Email address, name, phone number, country and mobile carrier, per HIBP. No passwords are listed.
Who is Hopamedia?
That's unknown. HIBP describes it as an unknown service, and no company has published a notice.
Should I change my password?
Passwords weren't in the data, so there's nothing to reset because of this breach alone. Do turn on two-factor authentication and watch for phishing and SIM swap attempts.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
