We Heart It weheartit.com We Heart It data breach: what happened and what to do
We Heart It was breached in November 2013, but the breach wasn't discovered until October 2017. Have I Been Pwned lists 8,600,635 accounts with usernames, email addresses and password hashes.
View all 13,115 breaches- Breach date
- 3 Nov 2013
- Affected
- 8,600,635
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
We Heart It, the image-based social network, was breached in November 2013. Nobody noticed until October 2017, when 8.6 million user records were sent to Have I Been Pwned. The company said it was alerted on October 11, 2017.
Have I Been Pwned lists 8,600,635 accounts. The data contains usernames, email addresses and password hashes. About 80% of the hashes were salted SHA-256, and the rest were MD5 with no salt. Unsalted MD5 is easy to crack, so those passwords should be considered readable.
How the company responded
We Heart It said the encryption used in 2013 was no longer secure and began re-hashing passwords with bcrypt. It emailed affected users and asked anyone who hadn't changed their password since 2013 to do so. Press coverage reported the company had found no evidence of unauthorized logins.
What it means for you
Four years passed between the breach and the discovery, so criminals had a long head start. Old data like this is often traded and reused long after the original theft.
If you had a We Heart It account around 2013 and your password was reused, other accounts are at risk of credential stuffing, where attackers try the same email and password on many sites. Because the site was popular with teenagers, many affected accounts are probably now tied to adults' main email addresses.
Treat any unexpected email that mentions your username or the site as suspicious.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Set a new, unique password on We Heart It. If you used the same password on other accounts, change those too. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Add 2FA to your email, banking and shopping accounts first. If an old password is still in circulation, a second step stops most takeover attempts.
- 3
Expect phishing that mentions the breach
Emails or texts that cite this breach, or claim your account is locked, are a common follow-up. Don't click the link. Open the site yourself instead.
- 4
Check whether your email is in this and other breaches
Run a free Serus scan. It checks your email and phone number against breach databases and the dark web, and Serus alerts you if they show up in a new one.
Frequently asked
Was I affected by the We Heart It breach?
Have I Been Pwned lists 8,600,635 accounts. Search your email on its site, or run a free Serus scan.
What was exposed in the We Heart It breach?
HIBP lists usernames, email addresses and password hashes, about 80% salted SHA-256 and the rest unsalted MD5.
Should I change my password?
Yes, especially if you haven't changed it since 2013 or used it elsewhere.
Why was it found so late?
The breach happened in November 2013 and the data only reached HIBP in October 2017.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
