Wishbone (2016) Data Breach

What happened?

In August 2016, the mobile app to "compare anything" known as Wishbone suffered a data breach . The data contained 9.4 million records with 2.2 million unique email addresses and was allegedly a subset of the complete data set. The exposed data included genders, birthdates, email addresses and phone numbers for an audience predominantly composed of teenagers and young adults.

When did it happen?

The breach date in the public record is August 7, 2016. The record was added to the catalogue on March 15, 2017 and last updated there on May 28, 2020.

What information was reported as exposed?

• Auth tokens
• Dates of birth
• Email addresses
• Genders
• Names
• Phone numbers
• Usernames

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Wishbone (2016) or used wishbone.io around August 7, 2016. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.