Ulmon ulmon.com Ulmon data breach: what happened and what to do
Ulmon, the travel app maker, was breached in January 2020. About 778,000 accounts had names, email addresses, bcrypt password hashes and in some cases phone numbers, bios and social profile IDs exposed.
View all 13,115 breaches- Breach date
- 26 Jan 2020
- Affected
- 777,769
- Data exposed
- Bios, Email addresses, Names, Passwords, Phone numbers, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Ulmon makes travel apps, including offline city maps. In January 2020 its account database was breached and later posted to a hacking forum. The service had almost 1.3 million records, which Have I Been Pwned (HIBP) reduces to 777,769 unique email addresses.
What was exposed
Records include names and email addresses, passwords stored as bcrypt hashes, and in some cases phone numbers, bios and social media profile IDs. Bcrypt is slow to crack by design, so strong passwords are likely to hold up. Short or common ones can still be guessed.
What Ulmon said
Ulmon published an information page on the incident in May 2020 addressed to its users. That page is the primary source for the company's account of what happened.
What it lets criminals do
Names and email addresses give phishing a personal touch, and a phone number adds text-message scams to the mix. A social profile ID lets someone find your public profile and write something that appears to know you. Bios sometimes include a city or job, which makes the message more convincing.
What to do
Change your Ulmon password and anywhere you reused it. Treat travel-themed emails, such as fake booking confirmations or refund offers, with suspicion, and check which apps are connected to your social accounts.
What to do if you were in it
- 1
Change your Ulmon password
Go to the account settings and pick a new password. If the site is gone or you no longer use it, you can skip this step. Ulmon's account page is the place to do it, but the reused copies matter more.
- 2
Change it everywhere you reused it
Look through your password manager or browser for logins that share the old password and replace each one, starting with email, banking and shopping accounts. Use a different password for every site.
- 3
Turn on two-factor authentication
Use an authenticator app or a hardware key on your email and any account that holds money or personal details. A stolen password alone then isn't enough to get in.
- 4
Expect phishing that uses your email address
Treat unexpected messages about your account, a prize or a password reset with suspicion. Don't click links in them: type the site address yourself or use its app.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan on the email addresses and phone numbers you use. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next leak without checking by hand.
Frequently asked
Was I affected by the Ulmon breach?
If you created an Ulmon account before 2020, possibly. Search your email on HIBP to check.
What was exposed in the Ulmon breach?
Names, email addresses, bcrypt password hashes, and for some people phone numbers, bios and social media profile IDs.
Are bcrypt passwords safe?
Bcrypt is far harder to crack than older hashes, so a strong unique password is likely safe. A weak one can still be guessed, so change it.
Should I change my password after the Ulmon breach?
Yes, on any site where you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
