Imavex imavex.com Imavex data breach: what happened and what to do
In August 2021 the website developer Imavex suffered a breach that exposed 878 thousand unique email addresses, with names, usernames, password material and some partial card data. Have I Been Pwned added it that month.
View all 13,115 breaches- Breach date
- 20 Aug 2021
- Affected
- 878,209
- Data exposed
- Email addresses, Genders, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses, Purchases, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Imavex is a website development company. Have I Been Pwned (HIBP) lists a breach dated August 20, 2021 with 878,209 affected accounts, added to its database six days later.
What happened
HIBP says the breach exposed 878 thousand unique email addresses. Beyond the user accounts, hundreds of thousands of form submissions and orders placed through Imavex customers' sites were also exposed. So you may be affected even if you never had an Imavex account: filling in a contact form or placing an order on a site Imavex built could be enough.
What was exposed
User records held names, usernames and password material. Some records also had genders and partial credit card data: the last 4 digits of the card and its expiry date. The form submissions and orders carried further personal information and the contents of whatever people typed into the form.
Last 4 digits and an expiry date aren't enough to make a purchase, but scammers use them to sound like your bank. Form contents can be more revealing than a profile, depending on what the form asked.
The company's response
Imavex has a breach information page. According to HIBP, the compromised system was retired in January 2024 and all customer data affected by the incident was permanently deleted.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Set a new password for any account tied to an Imavex-built site. If you used the same one anywhere else, change it there too, starting with email and banking. Use a password manager so every account gets its own.
- 2
Turn on two-factor authentication
Add an authenticator app or a passkey to your email, banking and shopping accounts. A leaked password alone then isn't enough to get in.
- 3
Be wary of messages that quote card details
A message that mentions the last 4 digits of your card may be a scam trying to sound like your bank. Call the number on the back of the card instead of replying.
- 4
Expect phishing that mentions this breach
Criminals use leaked names and emails to write convincing messages. Don't click links in unexpected emails or texts, and go to the company's site by typing the address yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks across breach databases and the dark web for your email and phone number and tells you what to do about each hit.
Frequently asked
Was I affected by the Imavex breach?
Possibly, even without an Imavex account, if you submitted a form or placed an order on a site Imavex built. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Emails, names, usernames, password material, some genders and partial card data, plus the contents of form submissions and orders.
Was my full credit card exposed?
HIBP only lists partial card data: the last 4 digits and expiry date.
How many people were affected?
HIBP lists 878,209 accounts.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
