Mangatoon mangatoon.mobi Mangatoon data breach: what happened and what to do
In May 2022, the manga app Mangatoon had a data breach affecting about 23 million accounts. It included names, email addresses, genders, social media profiles, auth tokens and passwords stored as salted MD5 hashes.
View all 13,115 breaches- Breach date
- 13 May 2022
- Affected
- 23,040,238
- Data exposed
- Auth tokens, Avatars, Email addresses, Genders, Names, Passwords, Social media profiles, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Mangatoon is a manga reading service based in Hong Kong. In May 2022 a breach exposed about 23 million subscriber records. Have I Been Pwned lists 23,040,238 accounts and says Mangatoon didn't respond to its attempts to make contact about the breach.
What was exposed
The data includes names, usernames, email addresses, genders, avatars, social media profiles, auth tokens from social logins and passwords stored as salted MD5 hashes.
The social login tokens are the unusual part. If you signed in with a social account, a token tied to that sign-in was part of the data, so it's worth reviewing which apps are connected to your social accounts and removing the ones you don't use. Salted MD5 is weak protection, and weak passwords can be recovered from it.
What to do
Change your Mangatoon password and any other account that shares it. If you signed in with a social account, remove the Mangatoon connection in that account's settings and sign out of other sessions.
Because the records pair your real name with your email address and social profile, expect phishing that addresses you by name. A message claiming your manga subscription has a billing problem is a typical example.
What to do if you were in it
- 1
Change the password, and every reuse of it
Change it on the affected service if you still have an account, then on every other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where you can. It blocks most account takeovers even when a password is already out there.
- 3
Review connected apps on your social accounts
If you signed in to Mangatoon with a social account, remove the app from the connected apps list in that account's settings, and sign out of all other sessions.
- 4
Expect phishing that uses these details
Expect emails that use your name or username. Don't click links in unexpected messages about your account.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak. It can't remove breach data, so the steps above are what protect you.
Frequently asked
Was I affected?
If you had a Mangatoon account before May 2022, possibly. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Names, usernames, email addresses, genders, avatars, social media profiles, auth tokens and passwords stored as salted MD5 hashes, per Have I Been Pwned.
Should I change my password?
Yes, and change it on any other site where you used the same one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
