Wishbone (2016) wishbone.io Wishbone data breach 2016: what happened and what to do
In August 2016, the Wishbone app suffered a breach exposing 2.2 million unique email addresses with names, dates of birth, genders, phone numbers and usernames. Most users were teenagers and young adults.
View all 13,115 breaches- Breach date
- 7 Aug 2016
- Affected
- 2,247,314
- Data exposed
- Auth tokens, Dates of birth, Email addresses, Genders, Names, Phone numbers, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In August 2016, the mobile app to "compare anything" known as Wishbone suffered a data breach. Have I Been Pwned says the data contained 9.4 million records with 2.2 million unique email addresses, and was allegedly a subset of the complete data set. It became public in March 2017, when Wishbone said it learned of unauthorized access to its API (Help Net Security).
What was exposed
Have I Been Pwned lists auth tokens, dates of birth, email addresses, genders, names, phone numbers and usernames. The audience was predominantly teenagers and young adults, which makes the data more sensitive than a typical email list.
What it means for you
A name, birthdate, phone number and email together are enough to make a scam message look real, or to find more about someone with a web search. If you were a teenager when you used the app, you are an adult now, and the same details can still be used for phishing and text scams. Auth tokens are tied to the old app, so they matter far less today.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Criminals use leaked emails and phone numbers to write messages that look personal. Don't click links or open attachments in unexpected emails or texts, and go to a company's site directly instead.
- 2
Treat texts that use your birthdate or name with suspicion
A text that quotes your date of birth or full name isn't proof it's genuine. Don't reply to unexpected texts, and verify through a number you already know.
- 3
Change reused passwords
The breach list doesn't include passwords, but if you used the same email and password across sites at that time, change them and turn on two-factor login.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which known breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked, so the steps here still matter.
Frequently asked
Was I affected by the Wishbone breach?
If you used Wishbone in 2016 with that email address, you may be among the 2.2 million unique addresses. Search your email on Have I Been Pwned.
What was exposed?
Auth tokens, dates of birth, email addresses, genders, names, phone numbers and usernames.
Were passwords leaked?
Have I Been Pwned doesn't list passwords for this breach.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
