BookCrossing bookcrossing.com BookCrossing data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In August 2022, BookCrossing disclosed a breach dating back to a database backup from November 2012. It exposed almost 1.6 million records with names, usernames, email and IP addresses, dates of birth and plain text passwords.
View all 13,118 breaches- Breach date
- 5 Nov 2012
- Affected
- 1,582,323
- Data exposed
- Dates of birth, Email addresses, Geographic locations, IP addresses, Names, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
BookCrossing is a book social networking site where people share and track books. In August 2022 it disclosed a data breach that dated back to a database backup from November 2012, according to Have I Been Pwned. The incident exposed almost 1.6M records. The site posted about it in its forum.
Sources checked: haveibeenpwned.com, bookcrossing.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The records held names, usernames, email addresses, IP addresses, dates of birth and passwords stored as plain text. Plain text means anyone with the data could read the passwords directly, with no cracking needed.
Why an old breach still matters
The data is from 2012, so many of those passwords are long gone. But people reuse passwords for years, and a date of birth never changes. If you had an account then and used the same password on other sites, you may still be exposed there. A leaked date of birth plus an email address also helps scammers who want to pass a security question or write a convincing message.
What to do
If you ever used BookCrossing, change the password there and on any account where you used the same one. Turn on two-factor login on your email.
What to do if you were in it
- 1
Change the password, and every place you reused it
Change it on this site first, then on any account that used the same or a similar password. A password manager makes unique passwords easy. Start with your email account, because password resets for other accounts usually go there.
- 2
Turn on two-factor login
Use an authenticator app or passkey where the site offers one. It stops most account takeovers even when a password is already out there.
- 3
Expect phishing that mentions the breach
Scammers use leaked details like your name, email or date of birth to sound convincing, and the FTC warns that they may pretend to be the breached company. Don't click links in messages about it. Contact the company through a phone number or website you already know. The FTC's breach guidance explains what to look for.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps monitoring and alerts you when they show up in a new leak. It can't remove data from a breach, so the other steps still matter.
Frequently asked
Was I affected by the BookCrossing breach?
Search your email on Have I Been Pwned, which holds this breach. It concerns accounts that existed when the 2012 backup was made.
What was exposed?
Names, usernames, email addresses, IP addresses, dates of birth and passwords stored as plain text.
Why was a 2012 backup breached in 2022?
According to Have I Been Pwned, BookCrossing disclosed in August 2022 a breach that dated back to a database backup from November 2012.
Should I change my password?
Yes, if you used BookCrossing around 2012 or since. Change it anywhere you reused it, because plain text passwords can be read directly.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
