SurveyLama surveylama.com SurveyLama data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In February 2024 the paid survey site SurveyLama was breached. Have I Been Pwned lists 4,426,879 accounts, with email addresses, names, dates of birth, phone numbers, physical and IP addresses and hashed passwords. SurveyLama said it had already emailed users.
View all 13,118 breaches- Breach date
- Feb 2024
- Affected
- 4,426,879
- Data exposed
- Dates of birth, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
SurveyLama is a paid survey website. In February 2024 it suffered a data breach, and Have I Been Pwned added it in April 2024, counting 4,426,879 accounts. When Have I Been Pwned contacted SurveyLama, the company said it had already notified users by email.
Sources checked: haveibeenpwned.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The data included email addresses, names, dates of birth, phone numbers, physical addresses and IP addresses. Passwords were stored as hashes: salted SHA-1, bcrypt or argon2, depending on the account. Hashes are scrambled versions of the passwords, and bcrypt and argon2 are much harder to crack than SHA-1.
What that lets criminals do
A name, date of birth, phone number and home address is a strong starting set for impersonation. Survey and rewards sites also attract scams, so a message about a payout or a prize that quotes your details deserves suspicion. Passwords that were hashed with SHA-1 and were weak or reused are the ones most at risk of being tried elsewhere.
What to do
Change the password first. Then deal with the phishing risk, since your contact details are in the data.
What to do if you were in it
- 1
Change your SurveyLama password, and any you reused
Some passwords were hashed with SHA-1, which is weaker than the other methods used. Change the password on your SurveyLama account and on every other account where you used the same one. Use a different password for each site and turn on two-factor authentication wherever it's offered.
- 2
Expect phishing that mentions the breach
Emails, texts and calls that quote your name or a real purchase look more convincing. Don't click links or open attachments in unexpected messages; go to the company's site yourself instead. The FTC explains how to spot phishing.
- 3
Treat messages about rewards or payouts with suspicion
Scammers lean on survey and reward themes. If a message about a payout asks you to log in or pay a fee, go to the site yourself or ignore it. The FTC has guidance on avoiding scams.
- 4
Check whether your email or phone is in this and other breaches
Search your email address on Have I Been Pwned. A free Serus scan also checks breach databases and the dark web and alerts you when your details appear. Serus can't remove data from a breach, so the steps above matter most.
Frequently asked
Was I affected by the SurveyLama breach?
Have I Been Pwned lists 4,426,879 accounts. Search your email address there to see whether yours is included.
What was exposed in the SurveyLama breach?
Email addresses, names, dates of birth, phone numbers, physical addresses, IP addresses and passwords stored as salted SHA-1, bcrypt or argon2 hashes.
Should I change my SurveyLama password?
Yes, if you had an account. Change it, and change it on any other site where you used the same password. Turn on two-factor authentication where you can.
Did SurveyLama tell users?
SurveyLama told Have I Been Pwned it had already notified users by email.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
