Houzz houzz.com Houzz data breach: what happened and what to do
In mid-2018, Houzz suffered a breach exposing almost 49 million unique email addresses with names, IP addresses, locations and salted password hashes or social profile links. Houzz disclosed it in February 2019.
View all 13,115 breaches- Breach date
- 23 May 2018
- Affected
- 48,881,308
- Data exposed
- Email addresses, Geographic locations, IP addresses, Names, Passwords, Social media profiles, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In mid-2018, the housing design website Houzz suffered a data breach. Have I Been Pwned says the company learned of it later that year and told impacted members in February 2019. Almost 49 million unique email addresses were in the breach.
Houzz said it opened an investigation with a forensics firm and told law enforcement. It emailed affected users and asked them to reset passwords as a precaution, and said no financial information or Social Security numbers were involved (Malwarebytes).
What was exposed
Have I Been Pwned lists email addresses, geographic locations, IP addresses, names, passwords, social media profiles and usernames. Passwords were salted hashes, and some accounts held links to the social media profiles used to sign in instead.
What it means for you
Names, emails and rough locations feed phishing that sounds local. A home-renovation site also invites messages about quotes and contractors, so be careful with anything claiming to be a payment or invoice. Reused passwords are the main account risk.
What to do if you were in it
- 1
Change your password, and every place you reused it
Set a new, unique password on Houzz, then change it on any other account that used the same or a similar one. A password manager makes unique passwords easy. Turn on two-factor login wherever it's offered.
- 2
Expect phishing that mentions the breach
Criminals use leaked names, emails and locations to write messages that look personal. Don't click links or open attachments in unexpected emails or texts, and go to a company's site directly instead.
- 3
Check the social accounts you used to sign in
Some records linked to social media profiles. Review where you've signed in with those accounts and turn on two-factor login for them.
- 4
Verify contractor and payment messages
Don't pay an invoice from an unexpected email or text. Contact the contractor using details you already have.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which known breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked, so the steps here still matter.
Frequently asked
Was I affected by the Houzz breach?
If you had a Houzz account in 2018, you may be among the nearly 49 million. Search your email on Have I Been Pwned.
What was exposed?
Email addresses, names, IP addresses, geographic locations, usernames, social media profiles and password hashes.
Were financial details exposed?
Houzz said no financial information or Social Security numbers were involved.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
