Trello trello.com Trello data breach: what happened and what to do
In January 2024, data scraped from Trello was put up for sale on a hacking forum. It covers 15,111,945 accounts and includes email addresses, names and usernames. Trello's owner, Atlassian, said Trello itself wasn't breached. No passwords were in the data.
View all 13,115 breaches- Breach date
- 16 Jan 2024
- Affected
- 15,111,945
- Data exposed
- Email addresses, Names, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In January 2024, a seller advertised a database of Trello member profiles on a hacking forum. Have I Been Pwned added it on January 22, 2024, and counts 15,111,945 accounts. The data holds email addresses, names and usernames.
How the data was collected
This wasn't a break-in. According to Have I Been Pwned, the data was obtained by enumerating a publicly accessible resource, feeding it email addresses taken from earlier breaches. Trello had an API that returned public profile details, and it could be queried by email address. That let someone connect a private email address to a public Trello profile, at scale.
Atlassian, which owns Trello, said its evidence pointed to someone testing a list of emails they already had against public profiles, and that it found no unauthorized access to Trello or its user profiles. Reporting at the time said Atlassian later restricted that lookup for people who aren't signed in.
What was exposed
The data contains email addresses, names and usernames. It has no passwords, so nobody can log in to your Trello account from this data alone.
What it does give a scammer is a verified link between your name and your email address, plus the username you use on Trello. That makes phishing more believable. A message that greets you by name and mentions Trello or a project board looks real at a glance.
Usernames also help someone guess your handle on other sites, so if you reuse one across services, it's worth knowing it's out there.
What the company said
Atlassian's position is that Trello wasn't hacked and that the data came from public profile information combined with emails gathered elsewhere. Researchers argued the company was downplaying the exposure, since the API made the bulk collection possible.
What to do if you were in it
- 1
Expect phishing that uses your name
Be wary of emails or texts that mention Trello, boards or account problems. Don't click links in them. Go to trello.com directly if you need to check something.
- 2
Turn on two-factor login for Trello
No password leaked, but two-factor login protects the account if a password is ever guessed or reused. Use an authenticator app or passkey.
- 3
Review what your Trello profile shows publicly
Your name and username are visible to others by design. Remove details you don't want public from your profile settings.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks for your email and phone number in known breaches and tells you which ones you appear in, so you know what to change.
Frequently asked
Was I affected by the Trello data breach?
If your email address is among the 15,111,945 accounts in the data, yes. You can check at Have I Been Pwned or run a free Serus scan.
Was my Trello password leaked?
No. The data contains email addresses, names and usernames only.
Was Trello hacked?
Atlassian says it found no unauthorized access to Trello. The data was gathered by querying public profile information using email addresses from previous breaches.
Should I change my password?
It isn't required because passwords weren't exposed. If you reuse your Trello password elsewhere, changing it is still a good idea.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
