Pemiblanc pemiblanc.com Pemiblanc data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Pemiblanc is a list of about 111 million email addresses and passwords, collated from earlier breaches and found on a French server in April 2018. Attackers used it to try logging in to other services.
View all 13,118 breaches- Breach date
- 2 Apr 2018
- Affected
- 110,964,206
- Data exposed
- Email addresses, Passwords
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Pemiblanc is a credential stuffing list: a file of email addresses and passwords gathered from earlier, unrelated breaches and used to try logging in to other services. Have I Been Pwned says it was found on a French server in April 2018 and added to the service in July 2018. It holds about 111 million email addresses and passwords.
Why it matters even though it isn't a breach of one company
No single company was hacked to make this list. It was collated from different data breaches, then used to mount account takeover attacks against other services. In credential stuffing, an attacker tries each email and password pair on many sites, betting that people reuse passwords. If your address is in Pemiblanc, one of your passwords was already public when the list was built.
What was exposed
Have I Been Pwned lists two data types: email addresses and passwords. Have I Been Pwned has not marked this entry as verified, which fits a list compiled from other sources.
What to do about it
The old password may still unlock something. Change it everywhere you used it, use a different password for each account, and turn on two-factor authentication where offered. A password manager makes the unique passwords realistic.
Sources checked: haveibeenpwned.com
Last verified against the official page:
What to do if you were in it
- 1
Change any password you may have reused
If you used the same password on more than one site, replace it everywhere, starting with email, banking and shopping accounts.
- 2
Use a unique password for every account
A password manager creates and stores them. Credential stuffing only works when one leaked password opens several doors.
- 3
Turn on two-factor authentication
With an authenticator app or a security key on, a stolen password alone doesn't get anyone into the account.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about it before a scammer uses it.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by Pemiblanc?
Search your email on Have I Been Pwned, or run a Serus scan, to see whether it's in this list.
What was in the Pemiblanc list?
Email addresses and passwords, according to Have I Been Pwned.
Should I change my password?
Yes, if you reused a password across sites. Change it everywhere it was used.
Sources
- Have I Been Pwned: Pemiblanc
- Have I Been Pwned: Pemiblanc Data Breach · haveibeenpwned.com
Something wrong or out of date? Tell us and we'll re-check it.
