Quidd quidd.co Quidd data breach: what happened and what to do
Quidd, the digital collectibles marketplace, was breached in 2019. Almost 4 million accounts had email addresses, usernames and bcrypt password hashes exposed. Quidd has not publicly disclosed the breach.
View all 13,115 breaches- Breach date
- Jul 2019
- Affected
- 3,805,863
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Quidd is an online marketplace for digital stickers, cards, toys and other collectibles. In 2019 its user data was taken, and the data was later sold and redistributed through hacking forums. Have I Been Pwned (HIBP) counts 3,805,863 affected accounts.
What was exposed
The records hold email addresses, usernames and passwords stored as bcrypt hashes. Bcrypt is built to be slow to crack, so strong passwords are likely to hold up. Reports from 2020 say some people claimed to have cracked large numbers of the hashes, so weak or common passwords should be treated as compromised.
What it lets criminals do
With an email address and username, scammers can aim phishing at collectors, often posing as the marketplace or as a buyer. Cracked passwords are tested on other accounts. Because Quidd handles purchases, an account takeover can also lead to stolen collectibles or unwanted charges.
The company's response
Press coverage at the time reported that Quidd had not publicly disclosed the incident.
What to do
Change your Quidd password and anywhere you reused it, then check your account's purchase history and linked payment method for anything you didn't do.
What to do if you were in it
- 1
Change your Quidd password
Go to the account settings and pick a new password. If the site is gone or you no longer use it, you can skip this step. Then check your purchase history and payment method for anything you didn't do.
- 2
Change it everywhere you reused it
Look through your password manager or browser for logins that share the old password and replace each one, starting with email, banking and shopping accounts. Use a different password for every site.
- 3
Turn on two-factor authentication
Use an authenticator app or a hardware key on your email and any account that holds money or personal details. A stolen password alone then isn't enough to get in.
- 4
Expect phishing that uses your email address
Treat unexpected messages about your account, a prize or a password reset with suspicion. Don't click links in them: type the site address yourself or use its app.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan on the email addresses and phone numbers you use. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next leak without checking by hand.
Frequently asked
Was I affected by the Quidd breach?
If you had a Quidd account in 2019, possibly. Search your email address on HIBP to check.
What was exposed in the Quidd breach?
Email addresses, usernames and passwords stored as bcrypt hashes.
Did Quidd disclose the breach?
Press coverage reported that Quidd had not publicly disclosed it.
Should I change my password after the Quidd breach?
Yes, especially if it was short or common, and on any site where you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
