TrueFire truefire.com TrueFire data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In February 2020, guitar lesson site TrueFire was breached, affecting about 600,000 members. Names, email and physical addresses, dates of birth, phone numbers, usernames, account balances and passwords (unsalted MD5 hashes) were exposed.
View all 13,118 breaches- Breach date
- 21 Feb 2020
- Affected
- 599,667
- Data exposed
- Account balances, Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
TrueFire is an online guitar tuition site. Have I Been Pwned (HIBP) dates its breach to 21 February 2020 and added it on 2 August 2020. The data covers about 600,000 members. HIBP got the data from dehashed.com.
TrueFire's own notice, as reported by Security Affairs, said it found the intrusion on 10 January 2020 and that an unauthorised person had access to its systems and to information entered on the website between 3 August 2019 and 14 January 2020. Reports describe a Magecart-style attack, where malicious code on checkout pages copies payment details.
Sources checked: haveibeenpwned.com, securityaffairs.com
Last verified against the official page:
What was exposed
HIBP lists account balances, dates of birth, email addresses, names, passwords, phone numbers, physical addresses and usernames. The passwords were stored as unsalted MD5 hashes, a weak method that makes many passwords quick to crack, especially short or common ones.
What it lets criminals do
A name, address, phone number and date of birth together are enough to make a phishing message or a scam call sound real. Cracked passwords get tried on other accounts, because many people reuse them. If you paid TrueFire by card in that period, keep an eye on your statements.
What to do
Change any password you shared with TrueFire, expect messages that use your details, and check your card statements for charges you don't recognize.
What to do if you were in it
- 1
Change your password, and any you reused
If you used your TrueFire password anywhere else, change it there too. A password manager makes unique passwords easy. Turn on two-factor login where you can.
- 2
Expect phishing that mentions the breach
Treat emails, texts and calls that quote your name, phone number or address as suspect. Don't click links in them; go to the company's site yourself.
- 3
Watch your card statements
If you bought from TrueFire around 2019 or 2020, look for charges you don't recognize and ask your card issuer for a new number if anything looks off.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Official filings
- Oregon Department of Justice , filed 27 Oct 2020
Timeline
-
The breach happened
-
Added to Have I Been Pwned
-
Reported to the Oregon Department of Justice
Frequently asked
Was I affected by the TrueFire breach?
You can look up your email on Have I Been Pwned, or run a free Serus scan. HIBP lists about 600,000 members in this breach.
What was exposed in the TrueFire breach?
Names, email addresses, physical addresses, phone numbers, dates of birth, usernames, account balances and passwords stored as unsalted MD5 hashes.
Should I change my password?
Yes, if you ever used it on TrueFire. Change it on every other site where you reused it, and turn on two-factor login.
Sources
- Have I Been Pwned: TrueFire
- Have I Been Pwned: TrueFire Data Breach · haveibeenpwned.com
- TrueFire Guitar tutoring website was hacked ... .... .... · securityaffairs.com
Something wrong or out of date? Tell us and we'll re-check it.
