StreetEasy streeteasy.com StreetEasy data breach: what happened and what to do
In about June 2016, the real estate site StreetEasy suffered a data breach. About 988,000 unique email addresses were exposed with names, usernames and SHA-1 password hashes, which appeared for sale on a dark web marketplace in February 2019.
View all 13,115 breaches- Breach date
- 28 Jun 2016
- Affected
- 988,230
- Data exposed
- Email addresses, Names, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In approximately June 2016, StreetEasy, the New York real estate listings site, suffered a data breach. The data didn't surface until February 2019, when it appeared for sale on a dark web marketplace.
Have I Been Pwned (HIBP) counts 988,230 unique email addresses in the breach. Alongside the emails were names, usernames and SHA-1 hashes of passwords.
What was exposed
Email addresses, names, usernames and passwords (as hashes).
SHA-1 is an old hashing method that is fast to compute, which makes it much easier to crack than modern ones like bcrypt. Assume that any StreetEasy password that was short, common or reused has been recovered. That is the main risk: criminals try the recovered password and email pair on other sites.
The real name and email combination also suits phishing. A message that mentions apartment hunting in New York, from someone who knows your name, looks more believable than a generic one.
The company's response
The Real Deal reported on the data's appearance in February 2019, and no company notice is public. If you had a StreetEasy account in 2016, change the password on any site where you used it.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on StreetEasy. If you used the same password anywhere else, change it there too, ideally with a password manager that generates a different one for each site.
- 2
Turn on two-factor login
Add an authenticator app or security key to your email, banking and shopping accounts first. A stolen password alone then won't get anyone in.
- 3
Expect phishing that mentions the breach
Emails and texts that quote your StreetEasy account, or claim to be from the company, are a common follow-up. Don't click links in them: go to the site directly instead.
- 4
Check whether your email is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number, and get an alert if a new one turns up.
Frequently asked
Was I affected by the StreetEasy data breach?
If you had a StreetEasy account around June 2016, possibly. HIBP lists 988,230 email addresses. Search your email on HIBP or run a free Serus scan to check.
What was exposed in the StreetEasy breach?
Email addresses, names, usernames and SHA-1 password hashes.
Should I change my password after the StreetEasy breach?
Yes, wherever you used the same password. SHA-1 hashes are relatively easy to crack, so assume weak passwords are known.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
