TaskRabbit taskrabbit.com TaskRabbit data breach: what happened and what to do
TaskRabbit found unauthorized access to its systems in April 2018. Its notice says names, usernames, passwords, dates of birth and truncated payment card information may have been compromised. It reset all user passwords.
View all 13,177 breaches- Breach date
- 11 Apr 2018
- Data exposed
- Names, Usernames, Passwords, Dates of birth, Truncated payment card information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
TaskRabbit, the marketplace for hiring people to do home tasks, told users in May 2018 that an intruder had gained access to its systems. The notice letter, filed with state attorneys general, says the company learned of the problem on April 12, 2018. It dates the incident to April 11, 2018.
The notice says the following may have been compromised: name, username, password, date of birth and truncated payment card information. Truncated means only part of the card number, not the full number. TaskRabbit took the site and app offline while it investigated, closed the entry point and reset all user passwords on April 19, 2018.
The notice gives no total for how many people were affected. State filings count residents of one state at a time, so the figures in them are not the total.
A password and a date of birth in the same record matter more than either alone. A password lets someone try your login on other sites if you reused it. A date of birth is one of the details identity thieves ask for when they open accounts or reset access to services. Partial card numbers are far less useful on their own, but they make a phishing message that mentions your card look believable.
TaskRabbit's response was to reset passwords for everyone, so users had to choose a new one at next login. If you used the same password anywhere else, that other account is the one still at risk.
Sources checked: iowaattorneygeneral.gov, bleepingcomputer.com, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Change your password and any you reused
Pick a new, unique password for the account and for every other site where you used the same one. Turn on two-factor authentication where it is offered.
- 2
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls about this incident with suspicion. Don't click links in them. Go to the company's website directly, or call a number printed on your card or bill.
- 3
Freeze your credit at all three bureaus
A credit freeze is free and stops new accounts from being opened in your name. Place it with Equifax, Experian and TransUnion, as the FTC explains at https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts. A date of birth was among the data in the notice, so this is worth doing.
- 4
Check card statements and report unfamiliar charges
Look through statements for the card you used and report any charge you don't recognize to your card issuer right away. Ask the issuer about replacing the card. The FTC lists next steps at https://www.identitytheft.gov/databreach.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases and the dark web for your email and phone number and alerts you if they show up. It detects and alerts; it can't remove data from a breach.
Official filings
- Washington Attorney General , filed 9 May 2018 : 77,618 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the TaskRabbit breach?
TaskRabbit's notice says information of users may have been compromised, and it reset every user's password. If you had an account in April 2018, assume you were included.
What did the TaskRabbit breach expose?
The notice lists names, usernames, passwords, dates of birth and truncated payment card information.
Should I change my password?
Yes, if you reused your TaskRabbit password anywhere. TaskRabbit reset its own passwords, but other sites using the old one are not covered.
How many people were affected?
The notice doesn't give a total. State filings only count residents of their own state.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
