ToonDoo toondoo.com ToonDoo data breach: what happened and what to do
ToonDoo, the comic creation site, was breached in August 2019. About 6 million accounts were exposed: email addresses, usernames, IP addresses, genders, locations and salted password hashes.
View all 13,115 breaches- Breach date
- 21 Aug 2019
- Affected
- 6,002,694
- Data exposed
- Email addresses, Genders, Geographic locations, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
ToonDoo is a website for making comic strips. In August 2019 its user database was taken, and in November 2019 the data was redistributed on a hacking forum. Have I Been Pwned (HIBP) lists 6,002,694 affected accounts.
What was exposed
The records include email addresses, usernames, IP addresses, genders, the location each person entered, and passwords stored as salted hashes. A salted hash is a scrambled version of a password that is harder to reverse than a plain one, but weak passwords can still be guessed offline. Other reports of the same data describe the hashes differently, so assume a simple password could be recovered.
What it lets criminals do
An email address plus a username is enough to send you convincing phishing. Anyone holding the leaked hashes can also try to crack them, then test the recovered password against your email, shopping and social accounts. That is why reused passwords are the real risk here.
The company's response
A notice filed with the Hawaii Office of Consumer Protection says the site's operator, JAMBAV, Inc., shut the website down after learning of the breach and reported it to the FBI.
Should you worry now?
The breach is several years old. If you still use the password you had on ToonDoo in 2019 anywhere, change it today. If you never reused it, your remaining exposure is mostly spam and phishing aimed at the email address you signed up with.
What to do if you were in it
- 1
Change your ToonDoo password
Go to the account settings and pick a new password. If the site is gone or you no longer use it, you can skip this step. ToonDoo shut its website down after the breach, so there may be nothing to log in to.
- 2
Change it everywhere you reused it
Look through your password manager or browser for logins that share the old password and replace each one, starting with email, banking and shopping accounts. Use a different password for every site.
- 3
Turn on two-factor authentication
Use an authenticator app or a hardware key on your email and any account that holds money or personal details. A stolen password alone then isn't enough to get in.
- 4
Expect phishing that uses your email address
Treat unexpected messages about your account, a prize or a password reset with suspicion. Don't click links in them: type the site address yourself or use its app.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan on the email addresses and phone numbers you use. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next leak without checking by hand.
Frequently asked
Was I affected by the ToonDoo breach?
If you had a ToonDoo account in 2019, probably. HIBP lets you search your email address to see whether it appears in this data.
What was exposed in the ToonDoo breach?
Email addresses, usernames, IP addresses, genders, locations and salted password hashes. No payment card data is listed in HIBP's entry.
Should I change my password after the ToonDoo breach?
Yes, anywhere you used the same or a similar password as on ToonDoo. Pick a unique one for each site and use a password manager.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
