AlpineReplay data breach: 898K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2024-10-17
In 2019, the snow sports tracking app AlpineReplay suffered a data breach that exposed 900k unique email addresses. Later rolled into the Trace service, the breach included names, usernames, genders, dates of birth, weights and passwords stored as either unsalted MD5 or bcrypt hashes. Exposed data: dates of birth, email addresses, genders, names, passwords, physical attributes, usernames. The breach dates from Aug 27, 2019; Have I Been Pwned loaded it on Oct 17, 2024.
What to do
- If you had a AlpineReplay account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
