We Heart It data breach: 8.6M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2017-10-14
In November 2013, the image-based social network We Heart It suffered a data breach. The incident wasn't discovered until October 2017 when 8.6 million user records were sent to HIBP. The data contained user names, email addresses and password hashes, 80% of which were salted SHA-256 with the remainder being MD5 with no salt. Exposed data: email addresses, passwords, usernames. The breach dates from Nov 3, 2013; Have I Been Pwned loaded it on Oct 14, 2017.
What to do
- If you had a We Heart It account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
