Gravatar data breach: 114.0M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2021-12-05
In October 2020, a security researcher published a technique for scraping large volumes of data from Gravatar, the service for providing globally unique avatars. 167 million names, usernames and MD5 hashes of email addresses used to reference users' avatars were subsequently scraped and distributed within the hacking community. 114 million of the MD5 hashes were cracked and distributed alongside the source hash, thus disclosing the original email address and accompanying data. Following the impacted email addresses being searchable in HIBP, Gravatar release an FAQ detailing the incident. Exposed data: email addresses, names, usernames. The breach dates from Oct 3, 2020; Have I Been Pwned loaded it on Dec 5, 2021.
What to do
- If you had a Gravatar account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
