Lumin PDF luminpdf.com Lumin PDF data breach: what happened and what to do
In April 2019, the PDF service Lumin PDF suffered a data breach. About 15.5 million records appeared online in September 2019, with names, email addresses, genders, spoken languages and bcrypt password hashes or Google auth tokens.
View all 13,115 breaches- Breach date
- Apr 2019
- Affected
- 15,453,048
- Data exposed
- Auth tokens, Email addresses, Genders, Names, Passwords, Spoken languages, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In April 2019, the PDF management service Lumin PDF suffered a data breach. Nobody heard about it until September. Then about 15.5 million records appeared for download on a hacking forum.
According to Have I Been Pwned (HIBP), the data had been left publicly exposed in a MongoDB database. Lumin PDF was reportedly contacted several times about it and didn't respond to the queries. That account comes from the reports on the breach, not from Lumin PDF.
What was exposed
HIBP lists auth tokens, email addresses, genders, names, passwords, spoken languages and usernames. Each account had a bcrypt password hash or a Google auth token.
Two things follow. A phishing message that knows your name and language looks personal. And if you signed in with Google, a leaked auth token works differently from a password: revoking the app's access in your Google account settings closes it.
What the company did
Lumin PDF hasn't published a notice that we know of. If you had an account, change the password. Then look at which apps can reach your Google account.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on Lumin PDF. If you used the same password anywhere else, change it there too, ideally with a password manager that generates a different one for each site.
- 2
Remove Lumin PDF's access to your Google account
If you signed in with Google, open your Google account's security settings, find third-party access, and remove Lumin PDF. Then sign in again only if you still use the service.
- 3
Turn on two-factor login
Add an authenticator app or security key to your email, banking and shopping accounts first. A stolen password alone then won't get anyone in.
- 4
Expect phishing that mentions the breach
Emails and texts that quote your Lumin PDF account, or claim to be from the company, are a common follow-up. Don't click links in them: go to the site directly instead.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number, and get an alert if a new one turns up.
Frequently asked
Was I affected by the Lumin PDF data breach?
If you had a Lumin PDF account in 2019, possibly. HIBP counts about 15.5 million accounts in this breach. Search your email on HIBP or run a free Serus scan to check.
What was exposed in the Lumin PDF breach?
Names, email addresses, usernames, genders, spoken languages, and either a bcrypt password hash or a Google auth token.
Should I change my password after the Lumin PDF breach?
Yes, and change it anywhere you reused it. If you signed in with Google, also remove Lumin PDF's access in your Google account settings.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
