Instant Checkmate instantcheckmate.com Instant Checkmate data breach: what happened and what to do
Instant Checkmate, a public records search service, had a data breach in 2019 that came to light in early 2023. It exposed almost 12 million customer emails and phone numbers, plus names and scrypt password hashes.
View all 13,115 breaches- Breach date
- 12 Apr 2019
- Affected
- 11,943,887
- Data exposed
- Email addresses, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In 2019, Instant Checkmate, a service people use to look up public records on others, suffered a data breach. It only came to light in early 2023, when the data of its customers was published and Have I Been Pwned added it to its database. The data covered almost 12 million unique customer email addresses.
The company's parent, PeopleConnect, confirmed the incident for Instant Checkmate and its sister service TruthFinder, according to BleepingComputer. The company said the list appeared to include customer accounts created between 2011 and 2019.
What was exposed
The breach exposed the following about customers:
- Email addresses
- Names
- Phone numbers
- Passwords, stored as scrypt hashes
This is customer account data, not the public records the service searches. A hash is a scrambled form of a password, and scrypt is a deliberately slow method, which makes cracking harder. Short ones get guessed.
What it lets criminals do
With your email, name and phone number in hand, a scammer can write a phishing email or text that reads like it came from someone who knows you. A scam message can also use the fact that you signed up with a people-search service as bait. If you reused your Instant Checkmate password on another site, treat that account as exposed too.
What the company did
The company said it investigated and found no evidence of malicious activity on its own networks, according to Bitdefender's report. It published a security notice on its site.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on Instant Checkmate, then change it anywhere else you used the same one. Use a password manager so each account gets its own.
- 2
Turn on two-factor login
Two-factor login on your email and other important accounts stops someone who has an old password from getting in with it alone.
- 3
Expect phishing that mentions the breach
Your email and phone number were in the data, so scam messages can use your name. Don't click links in unexpected emails or texts. Go to the site directly instead.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan checks your email and phone number against known breaches and tells you which accounts to secure first. Serus monitors breach databases and the dark web and alerts you, but it can't remove data that has already leaked.
Frequently asked
Was I affected by the Instant Checkmate data breach?
If you had an Instant Checkmate customer account, possibly. The company said the list appeared to cover accounts created from 2011 to 2019. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Instant Checkmate breach?
Customer email addresses and phone numbers, names, and scrypt password hashes, according to Have I Been Pwned.
Should I change my Instant Checkmate password?
Yes, if you still use it or reused it elsewhere. Change it everywhere you used it and turn on two-factor login on important accounts.
Sources
- Have I Been Pwned: InstantCheckmate
- haveibeenpwned.com/Breach/InstantCheckmate
- bleepingcomputer.com/news/security/truthfinder-instant-checkmate-confirm-data-breach-affecting-20m-customers/
- bitdefender.com/blog/hotforsecurity/data-of-over-20-million-truthfinder-and-instant-checkmate-users-leaked-on-hacking-forum
Something wrong or out of date? Tell us and we'll re-check it.
