Skip to content
vindicis

Wattpad data breach — are you affected?

In June 2020 the story-sharing site Wattpad was breached and almost 270 million records were first sold and then published on a hacking forum. They include names, usernames, email and IP addresses, genders, birth dates and bcrypt-hashed passwords. The mix of identity details and credentials makes the data useful for convincing phishing.

Key facts
Verified
Breach date
29 June 2020
Accounts affected
268,765,495
Added to catalogue
19 July 2020
Website
wattpad.com

Data exposed

  • Passwords, high risk
  • Dates of birth, medium risk
  • Bios, lower risk
  • Email addresses, lower risk
  • Genders, lower risk
  • Geographic locations, lower risk
  • IP addresses, lower risk
  • Names, lower risk
  • Social media profiles, lower risk
  • Usernames, lower risk
  • Website URLs, lower risk

Colour shows how damaging the data is if misused.Credentials, ID and bank dataContact and personal detailsOther profile data

What this means for you

Based on the types of data in this breach, in order of importance.

  • Change the password and turn on two-factor authentication

    Passwords or password hashes were part of this breach. Change the password on this service and on every site where you reused it, use a unique password for each account from a password manager, and enable two-factor authentication. You can test a password without sending it anywhere with the password checker.

  • Stay alert to identity fraud

    Birth dates and identity document numbers cannot be changed like a password. Be wary of anyone who quotes them to sound legitimate, check bank statements and credit reports regularly, and use a credit-file freeze or fraud alert where your country offers one.

  • Expect more targeted phishing

    Your email address ties you to this service, which is enough for a believable message such as a fake account warning. Check the sender and the web address before you sign in, and go to the site directly instead of using links in email.

  • Limit what attackers can personalise

    Names, employers, job titles and social profiles make impersonation and spear-phishing easier. Check what your public profiles reveal, and be careful with unexpected requests that use your real name or workplace.

Check your own email address

Run a free self-assessment for an email address you own. VINDICIS checks it against infostealer logs and several public breach sources and shows a summary in seconds.

Built for your own addresses. It is not a tool to look up other people.

Run a free self-assessmentCheck a password

Related breaches

Breaches that exposed similar kinds of data.

Frequently asked questions

Was my data in the Wattpad breach?

Only a check of your own address can tell. If you had an account with Wattpad around 2020, assume it might be. Run the free self-assessment with an email address you own: VINDICIS checks it against several public breach sources and shows a summary in seconds. It is built for your own addresses, not for looking up other people.

What information was exposed in the Wattpad breach?

According to the Have I Been Pwned catalogue, the Wattpad breach affected 268,765,495 accounts and exposed: Passwords, Dates of birth, Bios, Email addresses, Genders, Geographic locations, IP addresses, Names, Social media profiles, Usernames, Website URLs. The incident dates from 29 June 2020.

What should I do if I had a Wattpad account?

Change your Wattpad password and the password of every account that shared it, and turn on two-factor authentication. Treat unexpected emails, texts or letters that mention Wattpad with suspicion, and delete the account if you no longer use it.

Is it safe to check my email address on VINDICIS?

Yes. The free scan is not stored or logged, results stay in memory for four hours at most, and your browser only talks to this site. The password checker hashes locally and sends only five characters of the hash, so the password never leaves your device.