Wanelo wanelo.com Wanelo data breach: what happened and what to do
Around December 2018 the shopping site Wanelo suffered a data breach, later offered for sale on a dark web marketplace. Have I Been Pwned counts 23,165,793 accounts, with email addresses and passwords stored as MD5 or bcrypt hashes, plus names, addresses and IP addresses.
View all 13,115 breaches- Breach date
- 13 Dec 2018
- Affected
- 23,165,793
- Data exposed
- Email addresses, IP addresses, Names, Passwords, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In approximately December 2018, the digital mall Wanelo suffered a data breach. The data was later offered for sale on a dark web marketplace in April 2019, alongside a collection of other breaches. Have I Been Pwned added it on 30 September 2019 and counts 23,165,793 accounts, about 23 million unique email addresses.
What was exposed
The breach included email addresses and passwords stored as either MD5 or bcrypt hashes. After the first load, HIBP received further data containing names, shipping addresses and IP addresses. That second set wasn't directly linked to the email addresses and passwords.
What that lets criminals do
The two hash types matter. MD5 is old and fast, so simple passwords can be recovered quickly. bcrypt is built to be slow and is much harder to crack. If your password was weak and stored as MD5, assume it's known. Criminals try recovered passwords on other sites, because many people reuse them.
Shipping addresses and names, even unlinked, give scammers material for fake delivery and order messages. Treat unexpected texts about a package with care.
What to do
Change your Wanelo password and anywhere you reused it, use a unique password for each site, and turn on two-factor login on your email and other important accounts.
What to do if you were in it
- 1
Change the password, and every reuse of it
Change your Wanelo password, then any other account that used the same or a similar one. Start with your email.
- 2
Use a password manager and turn on two-factor login
Unique passwords mean one leak can't open other accounts. Add two-factor login on email, banking and shopping.
- 3
Expect fake delivery and order messages
Names and shipping addresses were in the data. Don't click links in unexpected texts or emails about a package.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't delete breach data, but it tells you what to change.
Frequently asked
Was I affected by the Wanelo data breach?
Enter your email address on Have I Been Pwned to see whether it was in the data. A free Serus scan also checks breach databases for your email and phone.
What was exposed in the Wanelo breach?
Email addresses, passwords stored as MD5 or bcrypt hashes, and separately names, shipping addresses and IP addresses, per Have I Been Pwned.
Should I change my password?
Yes, on Wanelo and anywhere you reused it. Weak passwords stored as MD5 hashes can be cracked quickly.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
