Young Living Essential Oils youngliving.com Young Living Essential Oils data breach: what happened and what to do
In December 2024, data claimed to come from Young Living Essential Oils was posted to a hacking forum: about 1.1 million email addresses with names and often dates of birth. Young Living didn't respond to Have I Been Pwned.
View all 13,115 breaches- Breach date
- 11 Dec 2024
- Affected
- 1,128,951
- Data exposed
- Dates of birth, Email addresses, Geographic locations, Names
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In December 2024, data said to come from the multi-level marketing company Young Living Essential Oils was posted to a hacking forum. Have I Been Pwned (HIBP), the breach notification service run by security researcher Troy Hunt, added it on December 19, 2024 and counts 1,128,951 unique email addresses.
What happened
The data turned up on a hacking forum around December 11, 2024. HIBP says it tried several times to reach Young Living about it and got no response, and Young Living hasn't published a breach notice. That matters: the breach is listed as verified in HIBP, but Young Living hasn't publicly explained how the data was taken. Coverage of the leak in the direct-selling trade press also questioned whether the company had notified customers.
What was exposed
Each record has an email address and a name. Many also carry the account's country and a date of birth. HIBP lists email addresses, names, geographic locations and dates of birth. No passwords or payment details are listed.
That is a small set of data, but it's enough to make a phishing email look real. A message that opens with your name and mentions Young Living, your orders or your distributor account is far more likely to get a click. A date of birth is also one of the pieces of information used to verify identity, so it's worth treating as exposed for good.
What this means for you
If you've ever bought from Young Living or signed up as a distributor, check HIBP with the email you used. Expect targeted phishing rather than account takeover, since passwords weren't part of the data. Change your Young Living password anyway if you reuse it elsewhere, because a leaked email makes password-guessing attacks easier.
Why a small leak still matters
Multi-level marketing accounts tie a person to a company and a product, and often a sales team. Criminals know that, and a leaked list of Young Living accounts is useful for more than one kind of scam. Fake "commission payment failed" emails work better when they start with a real name and a real email address.
Scammers can tailor a message to your region, and a date of birth lets them pass weak identity checks at other services. Those checks are the reason to avoid reusing your birth date as a PIN or security answer anywhere.
How to check your own exposure
Search the email address you used for Young Living on HIBP. If you've used more than one, check each. A match means your address was in this dataset, not that anyone has accessed your account. If the address shows up in other breaches too, that raises the odds of reused passwords being tried against your accounts, which is the practical reason to use a password manager and unique passwords.
What to do if you were in it
- 1
Check whether your email is in the leak
Search your email on Have I Been Pwned, or run a free Serus scan to check this and other breaches at once.
- 2
Expect phishing that mentions Young Living
Be suspicious of emails or texts about your Young Living account, orders or commissions. Go to the official site yourself instead of clicking a link.
- 3
Change your password and turn on 2FA
Passwords weren't listed in the leak, but change it on Young Living and anywhere you reused it, and turn on two-factor authentication where it's offered.
- 4
Treat your date of birth as public
Don't use it as a password or security answer. Watch accounts that use it to verify you.
- 5
Consider a credit freeze if you're worried
No Social Security numbers were listed, so this is optional, but a freeze with each credit bureau is free.
Frequently asked
Was I affected by the Young Living data breach?
Search your email on Have I Been Pwned. It lists about 1.1 million email addresses from the December 2024 leak.
What was exposed?
Email addresses and names, plus the account's country and often a date of birth, according to HIBP.
Did Young Living confirm the breach?
HIBP says the company didn't respond to its attempts to contact it, and Young Living hasn't published a public notice.
Should I change my password?
Passwords weren't in the data, but change yours if you reuse it elsewhere, and watch for phishing.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
