MyHeritage myheritage.com MyHeritage data breach: what happened and what to do
In October 2017, genealogy site MyHeritage was breached, and it was reported 7 months later. More than 92 million customer records were exposed: email addresses and salted SHA-1 password hashes. MyHeritage said family trees and DNA data sit on separate systems and weren't affected.
View all 13,115 breaches- Breach date
- 26 Oct 2017
- Affected
- 91,991,358
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
MyHeritage, the genealogy and DNA site, suffered a data breach in October 2017. A security researcher found a file of customer data on a private server outside the company and contacted MyHeritage, which announced the incident in June 2018, about 7 months later. Have I Been Pwned added the data in February 2019.
In 2019 the data appeared for sale on a dark web marketplace with several other large breaches, and it later circulated more widely.
What was exposed
Have I Been Pwned counts 91,991,358 customer records, and MyHeritage's own statement gave a figure of more than 92 million users who had registered by the time of the breach. The data was email addresses and salted SHA-1 password hashes. SHA-1 is a fast, older hashing method, so many weaker passwords can be cracked.
MyHeritage said it doesn't store passwords in plain form and that family trees and DNA data sit on separate systems with added security. The company said those weren't part of the incident.
What it means for you
An email address plus a cracked password is a working login anywhere you reused it. Genealogy sites also make a good phishing theme, because a message about a new family match or a DNA result feels personal.
If your MyHeritage password dates from 2017 or earlier, change it and turn on two-factor login. MyHeritage said it would speed up the rollout of stricter security measures including two-factor authentication.
What to do if you were in it
- 1
Change the password and anywhere you reused it
Set a new password on the affected account. Then change it on any other site where you used the same one, starting with email and banking. A password manager makes unique passwords painless.
- 2
Turn on two-factor login in MyHeritage
Open your account settings and switch on two-factor authentication. Do the same on your email, since that's the account that can reset everything else.
- 3
Expect phishing that mentions the breach
Criminals use your email address and interest in family history to write messages that look personal. Don't click links in unexpected emails or texts about your account. Go to the site directly instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you if your data shows up again.
Frequently asked
Was I affected by the MyHeritage data breach?
If you had a MyHeritage account by October 2017, probably. Search your email address on Have I Been Pwned to see whether it appears.
What was exposed?
Email addresses and salted SHA-1 password hashes. MyHeritage said family trees and DNA data weren't part of the incident.
Was my DNA data leaked?
MyHeritage said DNA data and family trees are stored on separate systems and weren't affected.
Should I change my password?
Yes, if you haven't changed it since 2017 or if you reused it on other sites.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
