Mashable mashable.com Mashable data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In mid-2020 a Mashable user database was breached and turned up publicly in November 2020. It covers 1.4 million unique email addresses, with names, genders, locations, IP addresses, social media profiles, expired auth tokens and days and months of birth.
View all 13,118 breaches- Breach date
- Jun 2020
- Affected
- 1,414,677
- Data exposed
- Auth tokens, Email addresses, Genders, Geographic locations, IP addresses, Names, Partial dates of birth, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In approximately mid-2020, Mashable suffered a data breach. The data turned up publicly in November 2020, and Have I Been Pwned added it to its database on 10 November 2020. It holds 1.4 million unique email addresses.
According to news coverage of the leak, the database was tied to an old feature that once let readers sign in with a social media account. Mashable said the feature was no longer in use. Mashable also temporarily disabled access to the affected accounts.
Sources checked: haveibeenpwned.com, portswigger.net
Last verified against the official page:
What was exposed
The data includes email addresses, names, genders, physical locations, IP addresses, links to social media profiles, expired auth tokens, and the day and month of birth (but not the year). Auth tokens are the codes a site hands out after you sign in with another service. These ones had already expired, so they shouldn't let anyone into your accounts.
What it lets criminals do
No password data is listed in the breach, so there's little to take over directly. The risk is targeted phishing. An email address, a name, a city and a social media profile are enough for a message that looks personal, such as a fake Mashable account notice or a prize offer. A day and month of birth also helps someone guess security answers or pass a weak identity check, so treat questions about your birthday with some suspicion.
What to do
You don't need to panic over this one, but it's worth a few minutes. Be careful with emails that mention Mashable or your social media login, and check which other breaches your email appears in.
What to do if you were in it
- 1
Expect phishing that looks personal
Messages may use your real name, city or social profile. Don't click links in unexpected emails about Mashable or your accounts. Go to the site yourself.
- 2
Review the social accounts you linked
If you ever used a social media account to sign in to Mashable, open that account's connected apps list and remove anything you no longer use.
- 3
Don't reuse your birthday as a security answer
The day and month of birth leaked. If a bank or other account uses your birthday for recovery, switch to a different method.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number and shows which leaks they appear in.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Mashable data breach?
The data covers 1.4 million email addresses. You can look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Mashable breach?
Email addresses, names, genders, physical locations, IP addresses, links to social media profiles, expired auth tokens and the day and month of birth.
Should I change my password?
No password data is listed in this breach. Changing it does no harm, but the bigger risk is phishing that uses your name and location.
Sources
- Have I Been Pwned: Mashable
- Have I Been Pwned: Mashable Data Breach · haveibeenpwned.com
- PortSwigger — Web security tools, training and research · portswigger.net
Something wrong or out of date? Tell us and we'll re-check it.
