The Post Millennial thepostmillennial.com The Post Millennial data breach: what happened and what to do
In May 2024, the news site The Post Millennial was hacked and data was posted online. Have I Been Pwned counts about 57 million accounts, including email addresses, names, phone numbers, physical addresses, usernames and some plain text passwords.
View all 13,115 breaches- Breach date
- 2 May 2024
- Affected
- 56,973,345
- Data exposed
- Email addresses, Genders, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
On May 2, 2024, the conservative news website The Post Millennial was hacked. Attackers defaced the site and posted a fake letter to its homepage, then released links to the data they had taken. Have I Been Pwned (HIBP) added the breach on May 10, 2024 and counts 56,973,345 accounts. That is about 57 million.
The leak was not one database. HIBP describes three separate sets of data. The first covered hundreds of writers and editors, with IP addresses, physical addresses and email addresses. The second covered tens of thousands of subscribers to the site, with names, email addresses, usernames, phone numbers and passwords stored as plain text. The third was a very large list of email addresses from thousands of mailing lists that the attackers said The Post Millennial had used.
That third set is where the 57 million comes from, and it comes with a caveat. HIBP notes that the link between the mailing lists and The Post Millennial has not been independently verified. The lists appear to come from campaigns that were not necessarily run by the site, and the personal details in them (names, phone numbers, physical addresses) depend on the campaign. So you may be in this breach even if you never read or subscribed to the site.
The data was later posted to a hacking forum and spread widely through torrents, which means it can't be pulled back.
What was exposed
HIBP lists these data types for the breach: email addresses, names, usernames, passwords, phone numbers, physical addresses, IP addresses and genders.
The plain text passwords matter most, but they only cover the subscriber set. If you had a subscriber account, treat that password as public. If you used it anywhere else, those accounts are the first place a criminal will try it. Automated tools test leaked email and password pairs against banks, shops and social networks within days.
For everyone else in the mailing list data, the exposure is mainly email addresses, and for some people a name, phone number or home address next to it. That is enough to make phishing and text scams more convincing. A message that greets you by name and mentions a real phone number looks legitimate. A home address in the mix means mail scams are possible too.
For the writers and editors, the physical addresses and IP addresses add a personal safety angle that goes beyond spam. If that is you, check what is public about your home address.
The site's response
The public record is mostly press coverage of the defacement and the leaked data, including Mediaite, rather than a notice from the site to its subscribers. HIBP's entry is marked verified, which means its operator confirmed the data is real.
What this means for you
If your email address is in the dataset, the practical risk is phishing, not account takeover. If a password of yours is in it, the risk is reuse. Both are fixable in an afternoon. The steps below are in order of how much they protect you.
What to do if you were in it
- 1
Check whether you are in this breach
Search your email address on Have I Been Pwned. If it shows up, you know which of the data types above could be tied to you.
- 2
Change the password, and anywhere you reused it
If you ever had an account on thepostmillennial.com, change that password and the password on any other site that used the same one. Use a different password for every site, and a password manager if you can't remember them all.
- 3
Turn on two-factor authentication
Add two-factor login on your email, bank and main social accounts first. An authenticator app is safer than text messages, because a leaked phone number makes SIM swap attempts easier.
- 4
Expect phishing that uses your details
Be wary of emails and texts that greet you by name or mention this breach. Don't click links in them. Go to the company's site directly instead.
- 5
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your email, passwords or other personal data appear, and tells you what to do next. It can't remove data that has already leaked, so the alert is the point: it tells you which passwords to change. You can run a free scan.
Frequently asked
Was I affected by The Post Millennial breach?
Search your email address on Have I Been Pwned. About 57 million accounts are listed, including people who only appeared on mailing lists, so you may be in it without ever visiting the site.
What was exposed?
HIBP lists email addresses, names, usernames, passwords, phone numbers, physical addresses, IP addresses and genders. Which of these apply to you depends on which set of data you were in.
Were passwords exposed in plain text?
HIBP says subscriber passwords were exposed as plain text. Change that password everywhere you used it.
Is the mailing list data verified?
HIBP states the link between the mailing lists and The Post Millennial has not been independently verified, while the breach entry itself is marked verified.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
