PetFlow petflow.com PetFlow data breach: what happened and what to do
In December 2017, pet care delivery service PetFlow was breached. Almost 1M accounts (990,919) had email addresses and passwords stored as unsalted MD5 hashes exposed, and the data later appeared for sale on a dark web marketplace.
View all 13,115 breaches- Breach date
- 9 Dec 2017
- Affected
- 990,919
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
PetFlow, a pet care delivery service, suffered a data breach in December 2017. The data later turned up for sale on a dark web marketplace. Have I Been Pwned (HIBP) added it in May 2020 and counts 990,919 accounts, so almost 1 million people.
What was exposed
The data contains email addresses and passwords. The passwords were stored as unsalted MD5 hashes. MD5 is an old, fast hashing method, and without a salt (a random value added to each password before hashing) attackers can crack common passwords in bulk. If your PetFlow password was simple, or you used it elsewhere, assume it's known.
That's the real risk here: password reuse. Criminals take leaked email and password pairs and try them on other sites, such as email, shopping and banking accounts. Your email address also puts you on lists for phishing that pretends to be a pet store or a delivery service.
What the company said
The breach was reported in news coverage in 2019, including TechCrunch, when the data was offered for sale. HIBP's entry is the source for the account count and the data types.
The breach is old, but the data doesn't expire. Passwords you set in 2017 and reused are still a way in today.
What to do if you were in it
- 1
Change your password, and every reuse of it
Change it on PetFlow if you still have an account first, then on any other account that uses the same or a similar password. A password manager makes unique ones easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where you can, so a leaked password alone isn't enough to get in.
- 3
Expect pet-themed phishing
Be wary of emails about orders, subscriptions or refunds, especially ones with links. Go to the company's site yourself instead of clicking.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak. It can't remove data that has already leaked, so the steps above are what protect you.
Frequently asked
Was I affected by the PetFlow data breach?
Look up your email on Have I Been Pwned, or run a free Serus scan. HIBP lists 990,919 accounts in this breach.
What was exposed in the PetFlow breach?
Email addresses and passwords, stored as unsalted MD5 hashes.
Should I change my password?
Yes, if you ever used one with PetFlow, and on any other site where you reused it. Turn on two-factor login too.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
