NetEase 163.com NetEase data breach: what happened and what to do
In October 2015 the Chinese site NetEase (163.com) was reported to have suffered a breach affecting hundreds of millions of subscribers. HIBP lists about 235 million accounts with email addresses and plain text passwords, flagged unverified.
View all 13,115 breaches- Breach date
- 19 Oct 2015
- Affected
- 234,842,089
- Data exposed
- Email addresses, Passwords
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In October 2015, the Chinese internet company NetEase, whose mail service runs on 163.com, was reported to have suffered a data breach affecting hundreds of millions of subscribers. Have I Been Pwned (HIBP) added 234,842,089 accounts to its index in October 2016.
HIBP marks this breach as "unverified". That is not a sign the data is fake. HIBP explains that several of its subscribers confirmed that a password they use appears in the data, so it appears legitimate. The label exists because it is hard to confirm Chinese breaches with the company and establish exactly how the data was taken.
What was exposed
HIBP lists email addresses and passwords. The passwords were in plain text, so anyone with the data could read them without any cracking. HIBP does not list names, phone numbers or payment details for this breach.
Even with only emails and passwords, the risk is real. Attackers run lists like this through login pages on other sites, a technique called credential stuffing. If you used your NetEase password anywhere else, that account is the one at risk.
What to do
Look up your email on HIBP to see if it is in the data. If it is, change the password on every account that used it and turn on two-factor login.
What to do if you were in it
- 1
Change your NetEase or 163.com password and any reuse of it
If you still have a NetEase or 163.com account, set a new password. Then change it on every other account that shares the old one or a close variation. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app on your email, banking and shopping accounts. A leaked password then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Scammers use leaked email addresses to send fake security alerts. Don't click links in unexpected messages. Go to the site yourself instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your details. Serus monitors breach databases and the dark web and alerts you, but it can't remove data from a breach.
Frequently asked
Was I affected by the NetEase breach?
If you had a NetEase or 163.com account in 2015, your email address and password may be in the data. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the NetEase breach?
HIBP lists email addresses and plain text passwords.
Why is the NetEase breach marked unverified?
HIBP says the data appears legitimate, because subscribers confirmed their passwords in it, but Chinese breaches are hard to verify with certainty, so it carries the unverified flag.
Should I change my password?
Yes, on NetEase and on any other account that used the same password.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
