Mathway mathway.com Mathway data breach: what happened and what to do
In January 2020 the math solver Mathway lost over 25 million records. HIBP counts about 25.7 million accounts with names, Google and Facebook IDs, email addresses and salted password hashes. Mathway reset all passwords.
View all 13,115 breaches- Breach date
- 13 Jan 2020
- Affected
- 25,692,862
- Data exposed
- Device information, Email addresses, Names, Passwords, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
The math solver Mathway suffered a data breach in January 2020. Have I Been Pwned (HIBP) lists 25,692,862 accounts. The data was later sold on a dark web marketplace, which is how the breach surfaced in May 2020.
What was exposed
The records held names, social login IDs, emails and salted password hashes. A salted hash is a scrambled password with a random value mixed in, which makes mass cracking slower than for plain hashes. Slower isn't impossible. A weak password can still be recovered.
The social login IDs are worth a mention. If you signed in to Mathway with Google or Facebook, those IDs link the leaked record to your social profile.
What this means for you
Attackers pair leaked emails with cracked passwords and try them on other sites. Real names make phishing look more believable.
The company's response
According to Silicon UK, Mathway said it hired a leading data security firm to investigate and fix any vulnerabilities. It notified affected customers and required password resets for all accounts.
What to do if you were in it
- 1
Change your password and any copy of it
Change your Mathway password, then change it on every other account where you used the same or a similar one. Mathway forced resets, but any older copy of that password is still out there. Turn on two-factor login where it's offered, and use a password manager so each account gets its own password.
- 2
Review social sign-ins
If you signed in with Google or Facebook, check which apps have access in your account settings. Remove the ones you don't use.
- 3
Expect phishing that uses real details
With your name and email address in circulation, scammers can send emails or texts that look personal. Don't click links in unexpected messages, and go to the company's site directly instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Mathway breach?
HIBP lists 25,692,862 accounts from the January 2020 breach. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Mathway breach?
Names, Google and Facebook IDs, email addresses and salted password hashes.
Should I change my password after the Mathway breach?
Yes, on Mathway and wherever you reused it. Turn on two-factor login on the accounts that matter most.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
