YouNow younow.com YouNow data breach: what happened and what to do
Data from the live-streaming service YouNow appeared for sale on a dark web marketplace in February 2019. Have I Been Pwned counts 18,241,518 accounts, with email addresses, IP addresses, names, usernames and social media profile links. No passwords were exposed.
View all 13,115 breaches- Breach date
- 15 Feb 2019
- Affected
- 18,241,518
- Data exposed
- Email addresses, IP addresses, Names, Social media profiles, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In February 2019, data from the live broadcasting service YouNow appeared for sale on a dark web marketplace. According to Have I Been Pwned, it's not clear when the breach itself took place. HIBP added the data on 18 July 2019 and counts 18,241,518 accounts. Many records had no email address attached, so the number of unique emails is lower than that total.
What was exposed
The data held email addresses and IP addresses, plus names, usernames and links to social media profiles. Passwords weren't part of it. YouNow sign-in runs through social providers.
What that lets criminals do
No password means no direct takeover of your YouNow account. The risk is phishing. An email address, a real name and a link to a social profile are enough for a believable message. A scammer can mention YouNow, your username or your streams to look legitimate. IP addresses give a rough location, which can make a fake message feel more personal.
Your sign-in ran through a social account, so review that one too. Same username elsewhere? Someone can match your profiles across sites.
What to do
Treat messages that mention YouNow or your username with suspicion, especially ones asking you to click a link or confirm a login. Check the security settings on the social account you used to sign in, and turn on two-factor login there.
What to do if you were in it
- 1
Expect phishing that mentions YouNow
Your email, name and username were in the data. Be wary of messages about your account, streams or a prize. Go to the site yourself instead of clicking links.
- 2
Secure the social account you used to sign in
YouNow sign-in runs through social providers, so that account is the key. Change its password and turn on two-factor login.
- 3
Don't reuse your YouNow username as a handle everywhere
Matching usernames let people link your profiles. On accounts that matter, use a different one.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't delete breach data, but it tells you what to change.
Frequently asked
Was I affected by the YouNow data breach?
You can enter your email address on Have I Been Pwned to see if it was in the data. A free Serus scan also checks breach databases for your email and phone.
What was exposed in the YouNow breach?
Email addresses, IP addresses, names, usernames and links to social media profiles, per Have I Been Pwned.
Were YouNow passwords leaked?
No. Have I Been Pwned says sign-in uses social providers, so no passwords were exposed in the breach.
Should I change my password?
Not for YouNow itself, since no password was in the data. Do secure the social account you signed in with.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
