Whitepages whitepages.com Whitepages data breach: what happened and what to do
In mid-2016, the telephone and address directory Whitepages was breached. Over 11 million email addresses leaked with names and SHA-1 or bcrypt password hashes, and the data was sold in early 2019.
View all 13,115 breaches- Breach date
- 27 Jun 2016
- Affected
- 11,657,763
- Data exposed
- Email addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In mid-2016, the telephone and address directory service Whitepages was among a group of sites that were breached. The data was then sold in early 2019, a sale The Register covered as account details from 16 sites offered on the dark web.
What was exposed
According to Have I Been Pwned, the data includes about 11.7 million unique email addresses, names and passwords stored as either SHA-1 or bcrypt hashes. SHA-1 is an older method that is fast to crack. These are account records for people who signed up on the site, separate from the public listings Whitepages publishes.
What it means for you
If you reused your Whitepages password, treat it as known. A name and email can also feed phishing that mentions your account.
What to do
Change the password anywhere you reused it and turn on two-factor login. If your address and phone number appear in people-search listings, that is a separate exposure from this breach, and one a free Serus scan can help you find.
What to do if you were in it
- 1
Change your Whitepages password, and any you reused
If you used the same or a similar password on another account, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey on your email and other important accounts. It blocks most takeovers even when a password is already out.
- 3
Expect phishing that fits the data
Expect emails that use your name and mention your account. Go to the site yourself instead of clicking links.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up again.
Frequently asked
Was I affected by the Whitepages breach?
Check your email on Have I Been Pwned or run a free Serus scan. If you had a Whitepages account in 2016, assume yes.
What was exposed?
Email addresses, names and passwords stored as SHA-1 or bcrypt hashes.
Does this include the Whitepages directory listings?
Have I Been Pwned lists account details, not the public directory. Listings in people-search sites are a separate exposure.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
