Covve covve.com Covve data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In February 2020, a large set of personal data from the Covve contacts app was found on an exposed Elasticsearch server. Have I Been Pwned counts about 22.8 million email addresses, with names, phone numbers, job titles and physical addresses.
View all 13,118 breaches- Breach date
- 20 Feb 2020
- Affected
- 22,802,117
- Data exposed
- Email addresses, Job titles, Names, Phone numbers, Physical addresses, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In February 2020, a large collection of personal information labeled "db8151dd" was found on a publicly accessible Elasticsearch server and provided to Have I Been Pwned. It was later identified as coming from the Covve contacts app. Covve said a third party had gained unauthorized access to a decommissioned legacy system, that no passwords were compromised and that it learned of the breach on May 15.
Sources checked: haveibeenpwned.com, portswigger.net
Last verified against the official page:
What was exposed
Have I Been Pwned counts 22,802,117 unique email addresses. The data included names, phone numbers, job titles, physical addresses and social media profiles, plus interactions between Covve users and their contacts.
What it means for you
You may be in this data even if you never used Covve: contact apps store details of the people in your address book. Criminals can use a name, job title and phone number to write a believable work email or text.
Why the numbers differ
Covve's own post put the affected users at about 90,000, while Have I Been Pwned counts 22,802,117 email addresses. The gap may reflect contacts stored in the database as well as Covve account holders; the sources don't explain it. This page uses Have I Been Pwned's count.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Emails, texts and calls that use your real details look convincing. Don't click links in unexpected messages; go to the company's site yourself.
- 2
Be wary of messages that use your job title
Fake invoice and executive requests rely on names and job titles. Check unusual requests by phone.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Covve breach?
Possibly, even without a Covve account, since the data came from users' contacts. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, phone numbers, job titles, physical addresses and social media profiles.
Should I change my password?
Covve said no passwords were compromised, so this breach alone doesn't require it. Unique passwords and two-factor login are still a good habit.
Sources
- Have I Been Pwned: db8151dd
- Have I Been Pwned: Covve Data Breach · haveibeenpwned.com
- PortSwigger — Web security tools, training and research · portswigger.net
Something wrong or out of date? Tell us and we'll re-check it.
