MangaDex mangadex.org MangaDex data breach: what happened and what to do
MangaDex, a manga fan site, had a breach in March 2021 that exposed almost 3 million subscribers (2,987,329 accounts in Have I Been Pwned). Email and IP addresses, usernames and bcrypt password hashes were exposed.
View all 13,115 breaches- Breach date
- 22 Mar 2021
- Affected
- 2,987,329
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
MangaDex is a manga reading and fan site. In March 2021 it was breached, and Have I Been Pwned lists 2,987,329 accounts.
What happened
The site was taken offline for maintenance on March 20, 2021. The Daily Swig reported that someone had gained access to an administrator account by reusing a session token found in an old database leak, through faulty session management. The site's maintainers said they hadn't yet confirmed a breach but were working on the assumption that there had been one. The data was later circulated within hacking groups.
What was exposed
Email addresses, IP addresses, usernames and passwords stored as bcrypt hashes. bcrypt is a slow hashing method, so strong passwords are hard to crack, but short or common ones aren't safe.
What that means for you
The risk is mostly account takeover and phishing. Anyone who cracks your hash can try your email and password on other sites. Your username and email also link your reading activity to a real address, which can feel personal, so be careful with emails that mention manga or MangaDex.
What to do if you were in it
- 1
Change your MangaDex password and anywhere you reused it
The passwords were stored as bcrypt hashes, which attackers can crack, especially weak ones. Pick a new, unique password for MangaDex and for any other account that shared it. A password manager makes that painless.
- 2
Turn on two-factor authentication
Use an authenticator app or a passkey on your email, banking and shopping accounts. A leaked password then isn't enough to log in.
- 3
Expect phishing that mentions MangaDex
Names, emails and phone numbers let scammers write believable messages. Treat unexpected emails and texts that mention MangaDex or your orders with suspicion, and go to the site directly instead of clicking links.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early. It can't remove data from a breach, so the alert is the useful part.
Frequently asked
Was I affected by the MangaDex breach?
Check your email on Have I Been Pwned, which lists 2,987,329 accounts.
What was exposed?
Email addresses, IP addresses, usernames and bcrypt password hashes.
How did the attacker get in?
The maintainers said it was through the reuse of a session token found in an old database leak, which gave access to an administrator account, per the Daily Swig.
Should I change my password?
Yes, for MangaDex and anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
