Xiaomi xiaomi.cn Xiaomi forum data breach: what happened and what to do
In August 2012 the Xiaomi user forum was breached. About 7 million email addresses appeared, with usernames, IP addresses and salted MD5 password hashes. Have I Been Pwned marks this breach as unverified.
View all 13,115 breaches- Breach date
- Aug 2012
- Affected
- 7,088,010
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In August 2012, the Xiaomi user forum website suffered a data breach. Have I Been Pwned (HIBP) added it on July 21, 2019. HIBP marks it as unverified, which means it couldn't fully confirm the data with the company.
What happened
The data surfaced years after the original incident, which is common for older breaches. HIBP got it with support from a data-breach search service. In all, 7 million email addresses appeared. Many of them were numeric aliases on an internal xiaomi.com domain, not real inboxes, so the number of real people affected is lower than the total. This is a forum database, not Xiaomi's phone or cloud accounts.
What was exposed
HIBP counts 7,088,010 accounts. The data classes are email addresses, IP addresses, passwords and usernames. Passwords were stored as salted MD5 hashes. MD5 is a fast, weak hash, so common passwords can be cracked.
What that lets criminals do
The data is old, so the main risk is for people who still use the same email and password combination today. If you reused a forum password, someone who cracked it could try it on newer accounts. Email addresses on their own mostly bring spam and phishing.
What to do now
If you had a Xiaomi forum account around 2012, change any password you still use that matches it. Use a unique password per site. Turn on two-factor login for your email. The breach is unverified, so treat it as likely rather than certain. Acting costs nothing.
What to do if you were in it
- 1
Change your old forum password, and every reuse of it
If you used the same or a similar password anywhere else, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email and other important accounts. It stops most takeovers even when an old password is out there.
- 3
Expect phishing that fits the data
Email addresses end up on spam and scam lists. Don't click links in messages that mention an account or a breach; go to the site yourself.
- 4
See which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone.
Frequently asked
Was I affected by the Xiaomi forum breach?
If you used the Xiaomi user forum around 2012, possibly. Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 7,088,010 accounts.
What was exposed in the Xiaomi breach?
Email addresses, IP addresses, usernames and salted MD5 password hashes.
Is the breach confirmed?
HIBP marks it as unverified. Many of the addresses were numeric aliases, so not all are real inboxes.
Should I change my password?
Yes, if you still use a password from that forum anywhere.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
