Life360 life360.com Life360 data breach: what happened and what to do
In March 2024, a flaw in a Life360 login API exposed the details of 442,519 customers. Have I Been Pwned lists email addresses, names and phone numbers. No passwords were part of the dataset it indexed.
View all 13,115 breaches- Breach date
- Mar 2024
- Affected
- 442,519
- Data exposed
- Email addresses, Names, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Life360 is the family location app that shows where your kids, partner or parents are on a map. In March 2024, someone abused a flaw in one of its login interfaces and pulled personal details for 442,519 customers. Have I Been Pwned (HIBP), the free breach-tracking service, added the dataset in July 2024.
What happened
Reporting at the time traced the exposure to a weakness in Life360's login API, the behind-the-scenes endpoint an app uses to check who you are. The flaw let outsiders query it and collect account details in bulk. The data was then posted publicly. Life360 fixed the API problem after the issue came to light.
This is easy to mix up with a second incident. In June 2024, Life360's CEO confirmed that someone had reached a Tile customer support platform and tried to extort the company. Life360 owns Tile, the Bluetooth tracker maker. Reports on that incident listed names, addresses, email addresses, phone numbers and Tile device ID numbers, and the company said credit card numbers, passwords and location data were not on that platform. The 442,519 figure and the HIBP entry belong to the earlier March login API problem, not to the Tile support incident.
What was exposed
HIBP lists three data types for the Life360 entry: email addresses, names and phone numbers. Press coverage described the phone numbers as partly masked. HIBP does not list passwords, home addresses or location history for this breach.
What that lets criminals do
A real name, a working email address and a phone number are enough to make a scam message believable. If you use Life360, expect emails and texts that look like they come from the app and mention your circle, a subscription renewal or a "location sharing problem". The link in them goes to a fake login page.
Phone numbers carry one more risk. A criminal who has your number and name can call your mobile carrier, pose as you and try to move your number to a SIM they control. That is a SIM swap, and it matters because many banks and email providers still send login codes by text. Your carrier's account PIN is the main defense.
Because Life360 is a location app, the context matters too. A stranger who knows you use a family tracking app can build a convincing story about a child or relative. Treat any urgent message that mentions family safety with suspicion until you have called the person directly.
The company's response
Life360 closed the API flaw. Public coverage found no direct notification to affected customers, and the company has not published a full account of the March incident. Its CEO addressed the separate Tile incident in public statements.
Is the data still out there?
Yes. Once a dataset is posted publicly it gets copied, and nobody can pull it back. That is why the useful steps are the ones that make the exposed details less useful: unique passwords, a carrier PIN and a healthy doubt about messages that arrive out of the blue.
What to do if you were in it
- 1
Change your Life360 password and anywhere you reused it
HIBP does not list passwords for this breach, but a changed password costs you two minutes. Use a unique one from a password manager and turn on two-factor authentication where Life360 and your email offer it.
- 2
Expect phishing and smishing that mentions Life360
Treat texts and emails about your account, a subscription or family safety as suspect. Open the app or type the address yourself instead of tapping the link.
- 3
Add a PIN to your mobile account
Call your carrier or open its app and set an account PIN or port-out lock. It makes a SIM swap with your phone number much harder.
- 4
Tell your circle
Family members on the same account share the same exposure. Send them the same warning about fake messages that name Life360.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next one early. It can't remove data from breach dumps, which is why the other steps here matter.
Frequently asked
Was I affected by the Life360 data breach?
Search your email address on Have I Been Pwned, or run a free Serus scan. HIBP lists 442,519 accounts for this breach. If your email is not listed, you may still have been in the separate Tile support incident.
What was exposed in the Life360 breach?
Email addresses, names and phone numbers, according to HIBP. It does not list passwords or location data.
Is the Life360 breach the same as the Tile breach?
No. The March 2024 login API flaw affected 442,519 accounts. The Tile incident in June 2024 involved a customer support platform, with names, addresses, emails, phone numbers and device IDs reported.
Should I change my Life360 password?
It is a sensible precaution even though passwords were not listed. Change it, and change any other account that shares it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
