Wishbone (2020) wishbone.io Wishbone data breach 2020: what happened and what to do
In January 2020, the app Wishbone had a second data breach, after one in 2016. Have I Been Pwned lists 9,705,172 accounts, with names, phone numbers, locations and unsalted MD5 password hashes, leaked online and widely redistributed.
View all 13,115 breaches- Breach date
- 27 Jan 2020
- Affected
- 9,705,172
- Data exposed
- Auth tokens, Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Names, Passwords, Phone numbers, Profile photos, Social media profiles, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Wishbone, a mobile app for comparing anything, suffered a data breach in January 2020, after an earlier one in 2016. Have I Been Pwned dates it to January 27, 2020 and says the data was leaked online and extensively redistributed.
Have I Been Pwned lists 9,705,172 unique email addresses. The exposed data includes auth tokens, dates of birth, email addresses, genders, geographic locations, IP addresses, names, passwords, phone numbers, profile photos, social media profiles and usernames. The passwords were stored as unsalted MD5 hashes, which are weak and quick to crack, so assume any password from that time is known.
Some outlets reported far larger totals, about 40 million records. Have I Been Pwned's count is the number of unique email addresses it confirmed.
With phone numbers, locations and social media profiles in one place, the risks are phishing, smishing and SIM swap attempts that use your real details. If you used the same password anywhere else, that account is at risk too.
Wishbone's 2020 breach came after its earlier 2016 incident, so if you used the app in both periods, your details may be in two separate leaks. Treat every password you ever used there as public.
What to do if you were in it
- 1
Change your Wishbone password and any copy of it
If you reuse the Wishbone password anywhere, change it there too, starting with email and banking. Use a unique password for each account and turn on two-factor authentication where it's offered.
- 2
Secure your phone number
Ask your mobile carrier to add a PIN or port-out lock to your account to make SIM swap attacks harder.
- 3
Treat unexpected emails and texts with suspicion
Criminals use breach details to make scam messages sound real. If a message mentions the breach or asks you to log in, click a link or share a code, go to the company's site yourself instead.
- 4
Turn on two-factor authentication
Use an authenticator app or a security key on important accounts rather than SMS codes.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks for your email and phone number in breach databases and the dark web and tells you what to do about each hit. Serus can't pull breach data back, but it alerts you when your details turn up.
Frequently asked
Was I affected by the Wishbone breach?
Have I Been Pwned lists almost 10 million unique email addresses. Search yours there or run a free Serus scan.
What was exposed in the Wishbone breach?
Names, email addresses, phone numbers, dates of birth, locations, IP addresses, usernames, social media profiles, auth tokens and unsalted MD5 password hashes.
Should I change my password?
Yes. MD5 hashes are quick to crack, so change it anywhere you used the same one and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
