Snapchat snapchat.com Snapchat data breach 2014: what happened and what to do
On 31 December 2013 and 1 January 2014, about 4.6 million Snapchat usernames and partly masked phone numbers were posted online. Have I Been Pwned lists 4,609,615 accounts, with usernames, phone numbers and geographic locations exposed.
View all 13,115 breaches- Breach date
- Jan 2014
- Made public
- 1 Jan 2014
- Affected
- 4,609,615
- Data exposed
- Geographic locations, Phone numbers, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In the early hours of 1 January 2014, a site called SnapchatDB.info posted a list of Snapchat usernames and phone numbers. Have I Been Pwned (HIBP) gives a breach date of 1 January 2014, added the data on 2 January 2014, and counts 4,609,615 accounts.
What happened
The data didn't come from Snapchat's servers being broken into in the usual sense. The security research group Gibson Security had been trying to get Snapchat to fix a flaw in the Find Friends feature since August 2013. The flaw let an attacker upload large numbers of random phone numbers and match them to Snapchat usernames. When Gibson Security judged Snapchat's fix insufficient, it published its findings and method on 25 December 2013.
The dump followed on New Year's Eve. Gibson Security said it didn't retrieve the data that was posted. The people behind the dump said they wanted to raise awareness and put public pressure on Snapchat to fix the problem. The site was suspended soon afterwards.
Snapchat's response blamed abuse of the feature and said that shortly after it had implemented practices like rate limiting to address the concerns.
What was exposed
HIBP lists geographic locations, phone numbers and usernames. The phone numbers had their last two digits removed in the published list. The location data was tied to the area code of each number.
What that lets criminals do
A username linked to a partial phone number is a thin record, but it has a use. Security experts flagged stalking as the main concern at the time. People tend to use the same username across services such as Facebook and Twitter, so a username can connect a phone number's owner to their accounts elsewhere.
The partial number also narrows what a scammer has to guess, and the area code gives a rough location.
Because no passwords or emails are in the data, there is no direct account takeover risk from this breach alone.
The company's response
Snapchat said it had added rate limiting and other measures. It didn't apologize at the time, according to coverage by BetaNews.
If you had a Snapchat account in 2014
This is an old breach and the data is limited. The practical step is to look at your own username and phone number as identifiers: if you use the same username everywhere, it links your accounts. Consider using different handles for accounts you want kept separate.
How to check your own exposure
Search your phone number and email address on Have I Been Pwned. Because the Snapchat dump masked the last two digits of each number, a match depends on how the data was indexed, and a miss doesn't prove your number was absent. In Snapchat's settings, look at who can contact you and find you, and tighten both. Then look at your handle: if it matches your handle on other apps, you may want to change it on the ones where you share less. These are small steps, and they are the ones that fit a breach of this kind.
What to do if you were in it
- 1
Review how linkable your usernames are
If you use the same username on several services, anyone who sees it can connect your accounts. Use different handles for accounts you want kept apart.
- 2
Lock down who can find you by phone number
In Snapchat's settings, review whether people can find you by your phone number, and apply the same check on other social apps.
- 3
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that quote your name, phone number or the company. Don't click links in them. Go to the company's site yourself, or call the number printed on a card or a bill.
- 4
Be wary of calls and texts from unknown numbers
Your phone number was part of the data. Don't confirm personal details to someone who contacts you unprompted.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email address or phone number. Breach data can't be taken back once it's out, so the scan tells you what to change and where to stay alert.
Frequently asked
Was I affected by the Snapchat data breach?
Check your email or phone number on Have I Been Pwned. HIBP lists 4,609,615 accounts. A Serus free scan checks your email and phone number against this and other breaches.
What was exposed in the Snapchat breach?
Usernames, phone numbers and geographic locations, according to HIBP. The last two digits of each phone number were removed in the published list.
Were passwords exposed?
No. HIBP doesn't list passwords for this breach.
How did it happen?
Researchers showed that the Find Friends feature could be used to match random phone numbers to usernames, and the list was published after Snapchat's first fix was judged insufficient.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
