Minted minted.com Minted data breach: what happened and what to do
In May 2020 the online marketplace Minted had a data breach that exposed about 4.4 million unique customer records: names, physical addresses, phone numbers and passwords stored as bcrypt hashes. The data was sold online.
View all 13,115 breaches- Breach date
- 6 May 2020
- Affected
- 4,418,182
- Data exposed
- Email addresses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Minted, an online marketplace for independent artists, had a data breach in May 2020. Have I Been Pwned (HIBP) counts 4.4 million unique customer records.
What happened
Minted said unauthorized actors obtained information from its user account database on 6 May 2020. The records were later offered for sale on a dark web marketplace. Minted said it had no reason to believe payment card information, address book data or customer photos were affected. Press coverage cited about 5 million records, but HIBP's count is 4.4 million.
What was exposed
Names, email addresses, physical addresses, phone numbers and passwords stored as bcrypt hashes. Bcrypt is a strong method, so well-chosen passwords are hard to crack, but short or common ones can still fall. Minted said a date of birth may also have been included for fewer than 1% of affected customers.
What it means for you
Expect phishing and scam calls that use your name and address. If your Minted password was weak or reused, change it everywhere you used it.
How to check your exposure
Search your email address on Have I Been Pwned, which holds this dataset and lets you look it up for free. If it shows up, review any account that used the same password and watch for unexpected calls or mail that uses your shipping address, since Minted customers often ship to home addresses.
What to do if you were in it
- 1
Change your password and turn on 2FA
Set a new, unique password for Minted. If you used that password anywhere else, change it there too, and turn on two-factor login on your important accounts. A password manager makes unique passwords easy.
- 2
Expect phishing and text scams that mention the breach
Treat unexpected emails, calls and texts that use your name, phone number or address with suspicion. Don't click links in them. Go to the company's site by typing the address yourself.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures early. It can't remove data from a breach, which is why the steps above matter.
Frequently asked
Was I affected by the Minted breach?
Look up your email on Have I Been Pwned. If Minted is listed, you were in the data.
What was exposed?
Names, email addresses, physical addresses, phone numbers and bcrypt-hashed passwords.
Is there a settlement?
A class action over the breach was reported by a California law firm. Check the court filings for the current status before relying on it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
