Swvl data breach: 4.2M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2020-07-31
In June 2020, the Egyptian bus operator Swvl suffered a data breach which impacted over 4 million members of the service. The exposed data included names, email addresses, phone numbers, profile photos, partial credit card data (type and last 4 digits) and passwords stored as bcrypt hashes, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by breachbase.pw. Exposed data: email addresses, names, partial credit card data, passwords, phone numbers, profile photos. The breach dates from Jun 23, 2020; Have I Been Pwned loaded it on Jul 31, 2020.
What to do
- If you had a Swvl account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
