Taobao taobao.com Taobao data breach: what happened and what to do
Around 2012, data allegedly from the Chinese shopping site Taobao exposed over 21 million email addresses and plain text passwords. Have I Been Pwned flags the breach as unverified.
View all 13,115 breaches- Breach date
- Jan 2012
- Affected
- 21,149,008
- Data exposed
- Email addresses, Passwords
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Taobao is a Chinese online shopping site. Around 2012, data that allegedly came from Taobao circulated, covering over 21 million subscribers. Have I Been Pwned (HIBP) added it to its collection in October 2016.
Unverified
HIBP marks this breach as unverified. Its description says there is evidence the data is legitimate, but that Chinese breaches are hard to verify with certainty. HIBP explains how it handles them in a post by Troy Hunt, linked below. Treat the breach as alleged: it hasn't been confirmed by Taobao.
What was exposed
HIBP lists two types of data: email addresses and passwords. The description says the passwords were in plain text, so no cracking is needed to read them.
What it lets criminals do
A plain text password next to an email address is the starting point for credential stuffing, where attackers try the same pair on other sites. It also makes targeted phishing easier, since the sender knows you had an account. If the data is genuine and you never changed that password, anything protected by it is at risk.
The data is more than a decade old, so the real danger is a password you used then and still use now.
What to do if you were in it
- 1
Change any password you used on Taobao
If you reused it on other sites, change it on each one. Give every account its own long, unique password.
- 2
Turn on two-factor authentication
Turn on 2FA for your email, banking and shopping accounts so a leaked password alone can't unlock them.
- 3
Be wary of messages about an old shopping account
Phishing emails may mention Taobao or online orders. Don't click links; open the site or app yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the steps here are what protect you.
Frequently asked
Was I affected by the Taobao data breach?
Only if you had a Taobao account around 2012 and the alleged data is genuine. Search your email on Have I Been Pwned or run a free Serus scan.
Is the Taobao breach confirmed?
No. HIBP flags it as unverified, though it notes evidence the data is legitimate.
What was exposed?
Email addresses and plain text passwords, per HIBP.
Should I change my password?
Yes, if you ever reused your Taobao password anywhere else.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
