SuperVPN & GeckoVPN data breach: 20.3M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2021-02-28
In February 2021, a series of "free" VPN services were breached including SuperVPN and GeckoVPN, exposing over 20M records. The data appeared together in a single file with a small number of records also included from FlashVPN, suggesting that all three brands may share the same platform. Impacted data also included email addresses, the country logged in from and the date and time each login occurred alongside device information including the make and model, IMSI number and serial number. Exposed data: device information, device serial numbers, email addresses, geographic locations, imsi numbers, login histories. The breach dates from Feb 25, 2021; Have I Been Pwned loaded it on Feb 28, 2021.
What to do
- If you had a SuperVPN & GeckoVPN account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
