Wishbone (2020) Data Breach

What happened?

In January 2020, the mobile app to "compare anything" Wishbone suffered another data breach which followed their breach from 2016. An extensive amount of personal information including almost 10M unique email addresses alongside names, phone numbers geographic locations and other personal attributes were leaked online and extensively redistributed. Passwords stored as unsalted MD5 hashes were also included in the breach.

When did it happen?

The breach date in the public record is January 27, 2020. The record was added to the catalogue on May 28, 2020 and last updated there on May 28, 2020.

What information was reported as exposed?

• Auth tokens
• Dates of birth
• Email addresses
• Genders
• Geographic locations
• IP addresses
• Names
• Passwords
• Phone numbers
• Profile photos
• Social media profiles
• Usernames

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Wishbone (2020) or used wishbone.io around January 27, 2020. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.