Terravision data breach — are you affected?
In February 2023 the European airport-transfer service Terravision suffered a breach that exposed over 2 million customer records: names, phone numbers, email addresses, salted password hashes and sometimes birth dates and countries. Individuals who tried to report the incident over several months received no reply.
- Breach date
- 1 February 2023
- Accounts affected
- 2,075,625
- Added to catalogue
- 23 April 2023
- Website
- terravision.eu
Data exposed
- Passwords, high risk
- Dates of birth, medium risk
- Phone numbers, medium risk
- Email addresses, lower risk
- Geographic locations, lower risk
- Names, lower risk
Colour shows how damaging the data is if misused.Credentials, ID and bank dataContact and personal detailsOther profile data
What this means for you
Based on the types of data in this breach, in order of importance.
Change the password and turn on two-factor authentication
Passwords or password hashes were part of this breach. Change the password on this service and on every site where you reused it, use a unique password for each account from a password manager, and enable two-factor authentication. You can test a password without sending it anywhere with the password checker.
Stay alert to identity fraud
Birth dates and identity document numbers cannot be changed like a password. Be wary of anyone who quotes them to sound legitimate, check bank statements and credit reports regularly, and use a credit-file freeze or fraud alert where your country offers one.
Watch for smishing and SIM-swap attempts
A leaked phone number lets criminals send convincing text messages and try to take over the number. Do not tap links in unexpected SMS, set a PIN with your mobile carrier and prefer an authenticator app to SMS codes.
Expect more targeted phishing
Your email address ties you to this service, which is enough for a believable message such as a fake account warning. Check the sender and the web address before you sign in, and go to the site directly instead of using links in email.
Limit what attackers can personalise
Names, employers, job titles and social profiles make impersonation and spear-phishing easier. Check what your public profiles reveal, and be careful with unexpected requests that use your real name or workplace.
Check your own email address
Run a free self-assessment for an email address you own. VINDICIS checks it against infostealer logs and several public breach sources and shows a summary in seconds.
Built for your own addresses. It is not a tool to look up other people.
Related breaches
Breaches that exposed similar kinds of data.
Animoto
2018 · animoto.com
22,437,749 accounts
- Passwords, high risk
- Dates of birth, medium risk
Evite
2013 · evite.com
100,985,047 accounts
- Passwords, high risk
- Dates of birth, medium risk
WiziShop
2020 · wizishop.fr
2,856,769 accounts
- Passwords, high risk
- Dates of birth, medium risk
Dubsmash
2018 · dubsmash.com
161,749,950 accounts
- Passwords, high risk
- Phone numbers, medium risk
Frequently asked questions
Was my data in the Terravision breach?
Only a check of your own address can tell. If you had an account with Terravision around 2023, assume it might be. Run the free self-assessment with an email address you own: VINDICIS checks it against several public breach sources and shows a summary in seconds. It is built for your own addresses, not for looking up other people.
What information was exposed in the Terravision breach?
According to the Have I Been Pwned catalogue, the Terravision breach affected 2,075,625 accounts and exposed: Passwords, Dates of birth, Phone numbers, Email addresses, Geographic locations, Names. The incident dates from 1 February 2023.
What should I do if I had a Terravision account?
Change your Terravision password and the password of every account that shared it, and turn on two-factor authentication. Treat unexpected emails, texts or letters that mention Terravision with suspicion, and delete the account if you no longer use it.
Is it safe to check my email address on VINDICIS?
Yes. The free scan is not stored or logged, results stay in memory for four hours at most, and your browser only talks to this site. The password checker hashes locally and sends only five characters of the hash, so the password never leaves your device.
