Locally locally.com Locally data breach: what happened and what to do
In October 2022 the shopping platform Locally suffered a data breach. Have I Been Pwned lists 362,619 accounts, with emails, phone numbers, physical addresses, purchases, partial card data and bcrypt password hashes exposed.
View all 13,115 breaches- Breach date
- Oct 2022
- Affected
- 362,619
- Data exposed
- Email addresses, Partial credit card data, Passwords, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Locally runs an online-to-offline shopping service that connects shoppers with nearby stores. A breach of its customer data dates to October 2022 and was added to Have I Been Pwned (HIBP) on 10 July 2023.
What happened
HIBP reports that Locally acknowledged the breach privately, and that it is unknown whether affected customers were ever notified. The details here come from HIBP's entry.
What was exposed
HIBP lists 362,619 accounts with email addresses, partial credit card data, passwords, phone numbers, physical addresses and purchases. The card data was limited to the card type and last four digits, and the passwords were bcrypt hashes.
Last four digits alone can't be used to make a purchase, but they help a scammer sound like your bank or the retailer. Your name, address, phone number and what you bought give a fraudster everything needed for a believable delivery or refund message. The hashed passwords are slow to crack, though a weak or reused password is still at risk.
What to do
Change your Locally password and any account that shares it. Be skeptical of messages about orders or refunds, and check your card statements for charges you don't recognize.
What to do if you were in it
- 1
Change your password and any reuse of it
Change it on the affected service and on every other account that uses the same or a similar password. A password manager makes unique passwords easy. Turn on two-factor login where it's offered.
- 2
Watch for package and delivery scams
A leaked name, phone number and home address make convincing fake delivery and order messages. Check order status in the retailer's own app or site, not through a link in a message.
- 3
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls as suspect, especially ones that name the company or offer help with the breach. Don't click links in them; go to the company's site yourself.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the Locally breach?
Look up your email on Have I Been Pwned, or run a free Serus scan. HIBP lists 362,619 accounts.
What was exposed?
Email addresses, phone numbers, physical addresses, purchases, the card type and last four digits, and bcrypt password hashes.
Did Locally notify customers?
HIBP says it is unknown whether customers were notified after Locally acknowledged the breach privately.
Should I change my password?
Yes, on Locally and anywhere you reused it, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
