xat xat.com xat data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In November 2015 the chat service xat was hacked and about 6 million accounts were exposed. The data included usernames, email addresses, IP addresses and hashed passwords. If you used xat, change any password you reused elsewhere.
View all 13,118 breaches- Breach date
- 4 Nov 2015
- Affected
- 5,968,783
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames, Website activity
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
xat is an online chatroom service that website owners use as a chat engine. In November 2015, an attacker got into xat's systems and took its registered user database. Have I Been Pwned records about 6 million exposed accounts, and xat published its own notice about the incident.
xat said the stolen database was likely downloaded and that it held registered usernames, email addresses, a hashed version of each password and IP addresses. A hash is a scrambled form of a password. It isn't the password itself, but weak or common passwords can often be guessed from their hashes.
Sources checked: haveibeenpwned.com, xat.com
Last verified against the official page:
What was exposed
Have I Been Pwned lists five types of data: email addresses, IP addresses, passwords, usernames and website activity. The email address and username together are enough to link an xat account to you. IP addresses give a rough location and the network you were on at the time.
What it means for you
The main risk is password reuse. If you used the same password on xat and on another account, someone who cracks the hash can try it elsewhere. The breach is old, but the data keeps circulating, so the advice hasn't expired. Email addresses from breaches also end up on spam and phishing lists.
A breach like this can't be reversed. Once copies are out, nobody can pull them back. What you can do is make the data useless: new passwords and two-factor login.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on xat, then change it on any other account that used the same or a similar one. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey wherever the site offers it. It blocks most account takeovers even when an old password is out there.
- 3
Expect phishing that uses these details
Criminals can use leaked email addresses and usernames to write messages that look personal. Don't click links in unexpected emails or texts. Go to the company's site yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone number and other details and alerts you when they show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the xat breach?
If you had a registered xat account in November 2015, probably. Search your email address on Have I Been Pwned, or run a free Serus scan, to see whether it appears.
What was exposed in the xat breach?
Usernames, email addresses, IP addresses, website activity and hashed passwords, according to Have I Been Pwned.
Should I change my password?
Yes, if you still use the password you had on xat anywhere. Change it on every account that shares it and turn on two-factor login.
Sources
- Have I Been Pwned: xat
- Have I Been Pwned: xat Data Breach · haveibeenpwned.com
- xat.com/databreach.html
Something wrong or out of date? Tell us and we'll re-check it.
