Kickstarter kickstarter.com Kickstarter data breach: what happened and what to do
Kickstarter announced a breach in February 2014. Have I Been Pwned lists 5,176,463 accounts with email addresses, usernames and salted SHA1 password hashes. Kickstarter said no credit card data was accessed.
View all 13,115 breaches- Breach date
- 16 Feb 2014
- Affected
- 5,176,463
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Kickstarter, the crowdfunding platform, announced in February 2014 that it had suffered a data breach. Have I Been Pwned lists 5,176,463 accounts, with unique email addresses, usernames and salted SHA1 hashes of passwords.
What Kickstarter said
The company said law enforcement told it about the intrusion. In its security notice it said hackers had gained access to some customer data and that no credit card data of any kind was accessed. It closed the security hole and asked all registered users to update their passwords.
Press coverage added that usernames, email addresses, mailing addresses and phone numbers were among the data accessed. Some people complained the notice came too slowly after the intrusion, while others said it was reasonable to secure the site first.
What it means for you
Even with salted hashes, a weak password can be cracked, because SHA1 is fast to compute. If your Kickstarter password was short or common, assume it is known.
The real risk is reuse. Attackers feed email and password pairs into login pages of other services and wait for matches. Backers often use the same email for pledges, PayPal receipts and shipping updates, which makes a taken-over email especially useful to a scammer.
Mailing addresses and phone numbers, where they were held, also open the door to convincing phishing about your pledges.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Set a new, unique password on Kickstarter. If you used the same password on other accounts, change those too. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Add 2FA to your email, banking and shopping accounts first. If an old password is still in circulation, a second step stops most takeover attempts.
- 3
Expect phishing that mentions the breach
Emails or texts that cite this breach, or claim your account is locked, are a common follow-up. Don't click the link. Open the site yourself instead.
- 4
Check whether your email is in this and other breaches
Run a free Serus scan. It checks your email and phone number against breach databases and the dark web, and Serus alerts you if they show up in a new one.
Frequently asked
Was I affected by the Kickstarter breach?
Have I Been Pwned lists 5,176,463 accounts. Search your email on its site, or run a free Serus scan.
What was exposed in the Kickstarter breach?
HIBP lists email addresses, usernames and salted SHA1 password hashes. Kickstarter said no credit card data was accessed.
Should I change my password?
Yes, if you had an account in 2014 or reused that password anywhere. Kickstarter asked all users to update theirs.
Is there a settlement?
None is described in the sources used for this page.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
