VK vk.com VK data breach: what happened and what to do
In 2012, Russian social network VK was hacked. The data surfaced in June 2016 with about 93 million accounts in Have I Been Pwned: names, emails, phone numbers and passwords.
View all 13,115 breaches- Breach date
- Jan 2012
- Affected
- 93,338,602
- Data exposed
- Email addresses, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
VK, the Russian social network, was hacked around 2012, according to Have I Been Pwned (HIBP). The data came to light in June 2016, when it was offered for sale on an online marketplace. HIBP counts 93,338,602 accounts.
The data includes names, email addresses, phone numbers and passwords. Press reports at the time said the passwords were stored in plain text. VK's position, as reported then, was that the site hadn't been breached and that old logins had been collected by fraudsters in 2011 and 2012. Motherboard's spot check of 100 sampled accounts found that 92 matched active accounts on the site.
That mix of a name, an email, a phone number and a readable password is useful to criminals for three reasons. It lets them try the same login on other sites. It gives scammers a phone number to text. And a real name lets them make a message look personal.
The breach is more than a decade old, but accounts that were never cleaned up are still the weak spot. People often keep the same password on a social network and an email account for years, and email is the key to resetting everything else.
VK isn't a service most readers outside Russia and its neighbors have used. If you do have an account or used to, the steps below are the ones that matter.
What to do if you were in it
- 1
Change your VK password and any copy of it
Change the password on VK, then on every other account that shared it. Email comes first, because it controls password resets for the rest.
- 2
Turn on two-factor authentication
Enable it in VK's security settings and on email. It stops a leaked password from being enough on its own.
- 3
Be careful with calls and texts
Your phone number was exposed. Don't act on a message that claims to be from VK or your bank. Go to the official app or site.
- 4
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web for your email, phone number and passwords, and alerts you when they show up. You can run a free scan at serus.ai. Serus can't remove data from a breach, but it tells you what to change.
Frequently asked
Was I affected by the VK breach?
If you had a VK account in or before 2012, possibly. Have I Been Pwned lets you search your email address or phone number, and Serus's free scan checks it against this and other breaches.
What was exposed?
Have I Been Pwned lists email addresses, names, passwords and phone numbers.
Should I change my password?
Yes. Change it on VK and anywhere else you used it, and use a unique password for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
