Thingiverse thingiverse.com Thingiverse data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
A 36GB Thingiverse database backup from October 2020 circulated online in October 2021. Have I Been Pwned counts 228,102 email addresses, with names, usernames, IP addresses, some dates of birth and physical addresses, and hashed passwords.
View all 13,118 breaches- Breach date
- 13 Oct 2020
- Affected
- 228,102
- Data exposed
- Dates of birth, Email addresses, IP addresses, Names, Passwords, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In October 2021, a database backup from the 3D model sharing site Thingiverse began circulating within the hacking community. Have I Been Pwned says the 36GB file dated back to October 2020 and held 228,102 unique email addresses, mostly alongside comments left on 3D models. It was added on 14 October 2021.
Thingiverse's owner, MakerBot, first said the leak affected a small number of users and non-sensitive data. A former MakerBot engineer who analysed the file disputed that, saying it held far more identifiable users. MakerBot later said the data was made available by human error. Reports differ on the final scope, so the 228,102 figure is Have I Been Pwned's count of unique email addresses.
Sources checked: haveibeenpwned.com, databreachtoday.com, fabbaloo.com
Last verified against the official page:
What was exposed
Have I Been Pwned lists dates of birth, email addresses, IP addresses, names, passwords, physical addresses and usernames. Passwords were stored as unsalted SHA-1 or bcrypt hashes, and physical addresses appeared in some cases.
What it means for you
Names with email addresses support phishing, and where a home address is included, scams can be more convincing or mail can be targeted. Unsalted SHA-1 hashes are fast to crack, so reused passwords are the main risk.
What to do if you were in it
- 1
Change your password, and any reuse of it
Change your Thingiverse password, then change it on every other account where you used the same or a similar one. Use a password manager so each account gets a unique password, and turn on two-factor login where it's offered.
- 2
Expect phishing that mentions the breach
Scammers use leaked email addresses and nameses to send convincing messages. Don't click links in unexpected emails or texts about your account, and go to the site directly instead.
- 3
Be careful with messages that know your address
Some records included a physical address. Treat unexpected parcels, letters or calls that quote your address or date of birth as possible scams and verify them with the company directly.
- 4
Limit what your profile shares
Remove your date of birth and address from your Thingiverse profile if you added them, and use a username that doesn't match other accounts.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus keeps monitoring breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Thingiverse breach?
If you had a Thingiverse account in October 2020, your email may be among the 228,102 in the data. Check it on Have I Been Pwned or run a free Serus scan.
What was exposed?
Dates of birth, email addresses, IP addresses, names, passwords, physical addresses and usernames. Passwords were hashed.
Did MakerBot confirm the leak?
MakerBot acknowledged the incident and said the data was made available through human error. Reports differ on how many users were affected.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
