Wattpad data breach: what happened and what to do

Wattpad is a website where people read and publish stories, and a large share of its users are teenagers. In June 2020 its user database was stolen, and what came out of it was one of the bigger account leaks of that year.

What happened

Have I Been Pwned dates the breach to 29 June 2020 and lists 268,765,495 exposed records. The data was first sold, then published and shared widely, so by the time it was added to HIBP in July 2020 it was no longer in one criminal's hands. BleepingComputer reported on it as it became public.

What was exposed

The records were detailed. They included email addresses and usernames, plus real names, genders and dates of birth. IP addresses, locations, bios, social media profiles and links to users' own websites were in there too. Passwords were stored as bcrypt hashes.

Bcrypt is a slow, deliberately expensive way of scrambling passwords. That's good news: it makes cracking each one slow. It isn't a guarantee, though. Short or common passwords such as a pet's name or a favourite character still fall quickly, and long unique ones usually don't.

The profile data matters as much as the passwords. A real name, birth date, location and social profile in one record lets someone build a convincing impersonation or a targeted phishing message. For younger users, a stolen birth date is a long-lived piece of identity, because it never changes.

Where the data went

The exposed records didn't stay with one seller. Because the data was shared widely after the sale, there's no single party to ask for deletion, and no way to pull it back. Removing yourself from the other places your details sit, such as people-search sites and data brokers, is a separate job. It limits how much a scammer can add to what leaked here.

How serious is it now?

It depends on who you are and what you used the account for. Someone who browsed under a throwaway username and a unique password has little to worry about. Someone who wrote under their real name, linked their other profiles and reused a password has more.

The breach is a few years old, so the main danger is reuse. If you used your Wattpad password elsewhere, change it. Your email, username and birth date were exposed and can't be changed back, so the realistic risks are targeted phishing and accounts guessed from reused passwords.

If you're a parent, it's worth knowing that a child's account on a site like this can leak a birth date and location years before they have a credit file. Keep an eye out for unfamiliar mail, calls or credit offers in their name later.