ClixSense Data Breach

What happened?

In September 2016, the paid-to-click site ClixSense suffered a data breach which exposed 2.4 million subscriber identities. The breached data was then posted online by the attackers who claimed it was a subset of a larger data breach totalling 6.6 million records. The leaked data was extensive and included names, physical, email and IP addresses, genders and birth dates, account balances and passwords stored as plain text.

When did it happen?

The breach date in the public record is September 4, 2016. The record was added to the catalogue on September 11, 2016 and last updated there on September 11, 2016.

What information was reported as exposed?

• Account balances
• Dates of birth
• Email addresses
• Genders
• IP addresses
• Names
• Passwords
• Payment histories
• Payment methods
• Physical addresses
• Usernames
• Website activity

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with ClixSense or used clixsense.com around September 4, 2016. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.