tumblr tumblr.com Tumblr data breach: what happened and what to do
In early 2013, Tumblr suffered a breach that exposed over 65 million accounts: email addresses and passwords stored as salted SHA1 hashes. The data surfaced for sale in 2016, and Tumblr reset affected passwords.
View all 13,115 breaches- Breach date
- 28 Feb 2013
- Affected
- 65,469,298
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In early 2013, tumblr suffered a data breach that exposed over 65 million accounts, according to Have I Been Pwned. The data was later put up for sale on a dark market website. It included email addresses and passwords stored as salted SHA1 hashes.
The public only learned of it in May 2016. Tumblr said a third party had gained access to the email addresses and hashed passwords of users who registered up to early 2013. It said it had found no evidence the data was used to get into accounts, and it reset the passwords of affected users as a precaution (SecurityWeek). Tumblr didn't give a number at first. Troy Hunt's analysis for Have I Been Pwned counted 65,469,298 records.
What was exposed
Email addresses and passwords, nothing else. The passwords were salted SHA1 hashes. Salting stops attackers from cracking every account at once, but SHA1 is fast, so short and common passwords can still be recovered.
What it means for you
A leaked email address on its own mostly means spam and phishing. The risk is reuse: if you used your 2013 Tumblr password on other sites, anyone who cracked it could try it elsewhere. Since the breach is more than a decade old, the likeliest harm now is old credentials being tried against newer accounts.
What to do if you were in it
- 1
Change your password, and every place you reused it
Set a new, unique password on Tumblr, then change it on any other account that used the same or a similar one. A password manager makes unique passwords easy. Turn on two-factor login wherever it's offered.
- 2
Expect phishing that mentions the breach
Criminals use leaked email addresses to write messages that look personal. Don't click links or open attachments in unexpected emails or texts, and go to a company's site directly instead.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which known breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked, so the steps here still matter.
Frequently asked
Was I affected by the Tumblr breach?
If you registered a Tumblr account before early 2013 with that email address, you may be one of the 65,469,298 records. Search your email on Have I Been Pwned.
What was exposed?
Email addresses and passwords stored as salted SHA1 hashes.
Should I change my password?
Yes, if you ever reused your old Tumblr password. Use a unique password everywhere and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
