ReverbNation reverbnation.com ReverbNation data breach: what happened and what to do
ReverbNation, the platform for musicians, was breached in January 2014. The breach wasn't identified until September 2015. It exposed 7,040,725 accounts: email addresses and salted SHA1 password hashes.
View all 13,115 breaches- Breach date
- Jan 2014
- Affected
- 7,040,725
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
ReverbNation is an online service that helps musicians build their careers. Its user data was breached in January 2014, but the company didn't identify the incident until September 2015, about 20 months later.
Have I Been Pwned lists 7,040,725 accounts in the breach. The data contains unique email addresses and salted SHA1 password hashes. Salting makes hashes harder to crack in bulk, but SHA1 is a fast algorithm, so weak or common passwords can still be guessed.
How it happened
ReverbNation's notice to customers said that a person, since charged, illegally accessed the computer systems of one of its vendors and from there reached a backup of the ReverbNation database. The company put the window of unauthorized access at January through May 2014 at most. Law enforcement told ReverbNation about the intrusion. It said no credit card data was accessed.
What was exposed
HIBP's record covers email addresses and passwords. The company's written notice letter, filed with the California Attorney General, listed more categories as possibly exposed for some customers, including names, postal addresses, phone numbers and dates of birth. ReverbNation told people who created accounts before May 1, 2014 to change their passwords.
What it means for you
With an email address and a guessable password, criminals can try the same pair on your other accounts. That's credential stuffing, and it works because people reuse passwords. An old account you forgot about is exactly where this starts.
If your ReverbNation account was created before 2014 and you reused that password anywhere, treat those other accounts as exposed.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Set a new, unique password on ReverbNation. If you used the same password on other accounts, change those too. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Add 2FA to your email, banking and shopping accounts first. If an old password is still in circulation, a second step stops most takeover attempts.
- 3
Expect phishing that mentions the breach
Emails or texts that cite this breach, or claim your account is locked, are a common follow-up. Don't click the link. Open the site yourself instead.
- 4
Check whether your email is in this and other breaches
Run a free Serus scan. It checks your email and phone number against breach databases and the dark web, and Serus alerts you if they show up in a new one.
Frequently asked
Was I affected by the ReverbNation breach?
Have I Been Pwned lists 7,040,725 accounts. Search your email on its site, or run a free Serus scan, which also covers other breaches.
What was exposed in the ReverbNation breach?
HIBP lists email addresses and salted SHA1 password hashes. The company's notice letter named further details, such as names and addresses, as possibly exposed for some customers.
Should I change my password?
Yes, if you had a ReverbNation account before May 2014, or if you reused that password anywhere else.
Why did it take so long to find out?
The company said it was told about the intrusion by law enforcement. It sent its notice in September 2015, after a breach in early 2014.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
