Scentbird scentbird.com Scentbird data breach: what happened and what to do
In June 2020, fragrance subscription service Scentbird was breached. It affected 5,814,988 accounts: names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes and indicators of password strength.
View all 13,115 breaches- Breach date
- 22 Jun 2020
- Affected
- 5,814,988
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Password strengths, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In June 2020, the online fragrance service Scentbird suffered a data breach that exposed the personal information of over 5.8 million customers. Have I Been Pwned (HIBP) added it in July 2020 and counts 5,814,988 accounts. The data was among records that a hacker leaked for free, according to BleepingComputer.
What was exposed
The data has names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes and indicators of password strength. Bcrypt is a slow hashing method, so strong passwords are hard to recover, while weak ones can be cracked. The strength indicators tell an attacker which accounts have weak passwords to go after first.
A name, email and date of birth let a criminal write a believable message about your subscription or billing. The date of birth can't be changed, which gives it a long shelf life for fraud attempts.
What the company said
The account count and data types come from HIBP's entry. BleepingComputer's report is the news source.
What to do if you were in it
- 1
Change your password, and every reuse of it
Change it on Scentbird first, then on any other account that uses the same or a similar password. A password manager makes unique ones easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where you can, so a leaked password alone isn't enough to get in.
- 3
Be wary of subscription and billing messages
Don't click links in emails or texts about your subscription, a failed payment or a refund. Log in to the site yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak. It can't remove data that has already leaked, so the steps above are what protect you.
Frequently asked
Was I affected by the Scentbird data breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 5,814,988 accounts.
What was exposed?
Dates of birth, email addresses, genders, names, password strengths and passwords stored as bcrypt hashes.
Should I change my password?
Yes, on Scentbird and anywhere you reused it. Turn on two-factor login where you can.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
