Ducks Unlimited Data Breach

What happened?

In mid-2021, Risk Based Security reported on a database sourced from Ducks Unlimited being traded online . The data dated back to January 2021 and contained 1.3M unique email addresses across both a membership list and a list of website users. Impacted data included names, phones numbers, physical addresses, dates of birth and passwords stored as unsalted MD5 hashes.

When did it happen?

The breach date in the public record is January 29, 2021. The record was added to the catalogue on November 16, 2021 and last updated there on November 16, 2021.

What information was reported as exposed?

• Dates of birth
• Email addresses
• Names
• Passwords
• Phone numbers
• Physical addresses

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Ducks Unlimited or used ducks.org around January 29, 2021. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.