Patreon patreon.com Patreon data breach: what happened and what to do
In October 2015, Patreon was hacked and over 16GB of data was released publicly. It held more than 2.3 million unique email addresses, millions of private messages, physical addresses and passwords stored as bcrypt hashes.
View all 13,115 breaches- Breach date
- Oct 2015
- Affected
- 2,330,382
- Data exposed
- Email addresses, Passwords, Payment histories, Physical addresses, Private messages, Website activity
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In October 2015, the crowdfunding site Patreon was hacked and the stolen data was published online. According to Have I Been Pwned, the dump was over 16GB, including almost 14GB of database records with more than 2.3 million unique email addresses, millions of private messages and passwords stored as bcrypt hashes.
Patreon's CEO said the intruders accessed registered names, email addresses, posts and some shipping addresses. He said full credit card numbers weren't stored on Patreon's servers and that passwords, Social Security numbers and tax form information stayed encrypted. Security press reported that the breach came from a debug version of the website that was publicly reachable (Sophos).
What was exposed
Have I Been Pwned lists email addresses, passwords, payment histories, physical addresses, private messages and website activity. Bcrypt is a slow hashing method built to make guessing passwords expensive, so strong passwords were hard to crack. Weak or common ones were not safe.
The private messages are the part that matters most for privacy. Messages between creators and supporters can name people and say things they never meant to be public. Together with a physical address, that gives a scammer plenty to build a convincing, personal message.
What to do now
If you had a Patreon account in 2015, treat that password as burned everywhere you used it. Then watch for emails or texts that reference your creators or your support history.
What to do if you were in it
- 1
Change your password, and every place you reused it
Set a new, unique password on Patreon, then change it on any other account that used the same or a similar one. A password manager makes unique passwords easy. Turn on two-factor login wherever it's offered.
- 2
Expect phishing that mentions the breach
Criminals use leaked email addresses and shipping details to write messages that look personal. Don't click links or open attachments in unexpected emails or texts, and go to a company's site directly instead.
- 3
Be careful with anything tied to your supporter history
Messages and payment histories were in the dump. Treat any contact that quotes a creator you backed or an amount you paid with suspicion until you've checked it independently.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which known breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked, so the steps here still matter.
Frequently asked
Was I affected by the Patreon breach?
If you had a Patreon account in October 2015, your email address may be among the more than 2.3 million in the dump. Have I Been Pwned lets you search by email.
What was exposed?
Email addresses, passwords stored as bcrypt hashes, payment histories, physical addresses, private messages and website activity, per Have I Been Pwned.
Should I change my password?
Yes, if you reused your 2015 Patreon password anywhere. Change it on every site that used it and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
