Breach report
MediaWattpad
Wattpad data breach exposes account info for millions of users
A database of roughly 270 million Wattpad user records was sold and then leaked for free on hacking forums in July 2020, exposing emails, usernames and bcrypt- or SHA-256-hashed passwords from the storytelling platform.
Reported by BleepingComputer
Records exposed
270M
About 270 million user records
Scale vs. largest on file
- When
- 2020
- How they got in
- Database theft sold and leaked on hacking forums (attributed to ShinyHunters)
- Sector
- Media
In early July 2020, a database containing account information for roughly 270 million users of Wattpad, the Toronto-based online storytelling platform, was offered privately on underground forums for about $100,000. Threat intelligence firms linked the sale to ShinyHunters, a group that had recently sold data from a string of other companies. On July 14, the full database was posted for free on a public hacking forum, dramatically widening its reach.
The records included usernames, real names, email addresses, passwords, general geographic locations and, for some users, dates of birth, genders and IP addresses. About 145 million passwords were hashed with bcrypt, a strong algorithm, while roughly 44 million used salted SHA-256, which is faster to crack. Wattpad said financial information, stories, private messages and phone numbers were not accessed.
Wattpad confirmed it was investigating a security incident and had brought in outside security experts and law enforcement. On July 20, it announced that it would reset all user passwords as a precaution and require members to create new ones. The company did not publicly explain how the attackers had obtained the data.
The breach was one of the largest of 2020 by record count and drew particular concern because Wattpad's audience skews young, with many teenagers among its tens of millions of monthly readers and writers. Security experts warned that the combination of emails, names and locations would be useful for targeted phishing. Breach-notification service Have I Been Pwned later added nearly 269 million unique accounts from the leak. Wattpad was acquired by South Korean internet company Naver in early 2021, a deal announced months after the incident.
The Wattpad leak showed how quickly a sold database can become public once it moves from private sale to free distribution on forums, multiplying the number of criminals with access. It also underscored the importance of consistent password hashing: the SHA-256 portion of the data was a much softer target than the bcrypt portion. For users, especially younger ones who may reuse passwords across apps and school accounts, it reinforced the need for unique credentials and awareness of phishing attempts that cite real account details.